From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38543) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bHyRp-0002AH-RC for qemu-devel@nongnu.org; Tue, 28 Jun 2016 15:13:26 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bHyRo-0006xX-RT for qemu-devel@nongnu.org; Tue, 28 Jun 2016 15:13:25 -0400 Received: from mail-lf0-x231.google.com ([2a00:1450:4010:c07::231]:36785) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bHyRo-0006xI-JW for qemu-devel@nongnu.org; Tue, 28 Jun 2016 15:13:24 -0400 Received: by mail-lf0-x231.google.com with SMTP id q132so18132178lfe.3 for ; Tue, 28 Jun 2016 12:13:24 -0700 (PDT) From: riku.voipio@linaro.org Date: Tue, 28 Jun 2016 22:12:51 +0300 Message-Id: <48dc0f2c3d87c74c31a27e1d17dabf26c378b1e8.1467138806.git.riku.voipio@linaro.org> In-Reply-To: References: Subject: [Qemu-devel] [PULL v2 17/24] linux-user: fd_trans_host_to_target_data() must process only received data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Laurent Vivier From: Laurent Vivier if we process the whole buffer, the netlink helpers can try to swap invalid data. Signed-off-by: Laurent Vivier Signed-off-by: Riku Voipio Reviewed-by: Peter Maydell --- linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index 33409c0..4b0d791 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2991,7 +2991,7 @@ static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp, len = ret; if (fd_trans_host_to_target_data(fd)) { ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base, - msg.msg_iov->iov_len); + len); } else { ret = host_to_target_cmsg(msgp, &msg); } -- 2.1.4