Fix errors in unlock_user() calls:
- unlock_user() with len=1 instead of len=written
- unlock_user() with len=1 instead of len=0

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 bsd-user/bsd-misc.c | 2 +-
 bsd-user/bsd-misc.h | 2 +-
 bsd-user/bsdload.c  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bsd-user/bsd-misc.c b/bsd-user/bsd-misc.c
index 3e1968718f..eac3edb8ac 100644
--- a/bsd-user/bsd-misc.c
+++ b/bsd-user/bsd-misc.c
@@ -95,7 +95,7 @@ abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
     for (i = 0; i < nsems; i++) {
         __put_user(array[i], host_array + i);
     }
-    unlock_user(array, target_addr, 1);
+    unlock_user(array, target_addr, nsems * sizeof(unsigned short));
     return 0;
 }

diff --git a/bsd-user/bsd-misc.h b/bsd-user/bsd-misc.h
index 13e40d9cde..13abc7e3b1 100644
--- a/bsd-user/bsd-misc.h
+++ b/bsd-user/bsd-misc.h
@@ -211,7 +211,7 @@ static inline abi_long do_bsd___semctl(int semid, int semnum, int target_cmd,
         break;
     }
 out:
-    unlock_user(target_un, un_ptr, 1);
+    unlock_user(target_un, un_ptr, 0);
     return ret;
 }

diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
index 5b3c061a45..9ea3b93825 100644
--- a/bsd-user/bsdload.c
+++ b/bsd-user/bsdload.c
@@ -30,7 +30,7 @@ abi_long memcpy_to_target(abi_ulong dest, const void *src,
         return -TARGET_EFAULT;
     }
     memcpy(host_ptr, src, len);
-    unlock_user(host_ptr, dest, 1);
+    unlock_user(host_ptr, dest, len);
     return 0;
 }

--
2.51.0