With a little help from Paul yesterday, I was able to come up with a scheme for detecting bad pointers passed to system calls in linux-user mode. This is used to return EFAULT as would be done on a real kernel. The attached patch is very preliminary, but shows how it can be done. I'm sending it now to solicit comments. The patch currently just add a seperate call to validate the address. Per yesterdays discussion, the checking should be folded into lock_user(), but it's not a trivial drop in as lock_user() and lock_user_struct() are used in different ways in different places, and none of them are actually checking a return value. I'm still thinking on how best to accomplish this part. The end result, is that the tests in LTPs msg* tests that try to generate EFAULT can now do so (and thus PASS). Stuart Stuart R. Anderson anderson@netsweng.com Network & Software Engineering http://www.netsweng.com/ 1024D/37A79149: 0791 D3B8 9A4C 2CDC A31F BD03 0A62 E534 37A7 9149