From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:59033) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bGNo8-0000ze-6I for qemu-devel@nongnu.org; Fri, 24 Jun 2016 05:53:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bGNo2-0003Rl-Iw for qemu-devel@nongnu.org; Fri, 24 Jun 2016 05:53:51 -0400 Received: from mail-lf0-x233.google.com ([2a00:1450:4010:c07::233]:35439) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bGNo2-0003Rf-Ag for qemu-devel@nongnu.org; Fri, 24 Jun 2016 05:53:46 -0400 Received: by mail-lf0-x233.google.com with SMTP id l188so111654825lfe.2 for ; Fri, 24 Jun 2016 02:53:46 -0700 (PDT) From: riku.voipio@linaro.org Date: Fri, 24 Jun 2016 12:53:12 +0300 Message-Id: In-Reply-To: References: Subject: [Qemu-devel] [PULL 17/24] linux-user: fd_trans_host_to_target_data() must process only received data List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Laurent Vivier From: Laurent Vivier if we process the whole buffer, the netlink helpers can try to swap invalid data. Signed-off-by: Laurent Vivier Signed-off-by: Riku Voipio Reviewed-by: Peter Maydell --- linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index ce9f020..b635127 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -2991,7 +2991,7 @@ static abi_long do_sendrecvmsg_locked(int fd, struct target_msghdr *msgp, len = ret; if (fd_trans_host_to_target_data(fd)) { ret = fd_trans_host_to_target_data(fd)(msg.msg_iov->iov_base, - msg.msg_iov->iov_len); + len); } else { ret = host_to_target_cmsg(msgp, &msg); } -- 2.1.4