Re: [PATCH] linux-user: Check for EFAULT failure in nanosleep

[Richard Henderson <richard.henderson@linaro.org>]

On 7/10/25 10:43, Peter Maydell wrote:
> target_to_host_timespec() returns an error if the memory the guest
> passed us isn't actually readable.  We check for this everywhere
> except the callsite in the TARGET_NR_nanosleep case, so this mistake
> was caught by a Coverity heuristic.
> 
> Add the missing error checks to the calls that convert between the
> host and target timespec structs.
> 
> Coverity: CID 1507104
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> Tested via the LTP nanosleep tests, but they don't actually exercise
> the EFAULT codepaths...
> 
>   linux-user/syscall.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index fc37028597c..c600d5ccc0e 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -11630,10 +11630,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>       case TARGET_NR_nanosleep:
>           {
>               struct timespec req, rem;
> -            target_to_host_timespec(&req, arg1);
> +            if (target_to_host_timespec(&req, arg1)) {
> +                return -TARGET_EFAULT;
> +            }
>               ret = get_errno(safe_nanosleep(&req, &rem));
>               if (is_error(ret) && arg2) {
> -                host_to_target_timespec(arg2, &rem);
> +                if (host_to_target_timespec(arg2, &rem)) {
> +                    return -TARGET_EFAULT;
> +                }
>               }
>           }
>           return ret;