From: Matt Turner <[email protected]> If lock_user_struct fails, frame is uninitialized but the badframe label unconditionally calls unlock_user_struct on it. Handle the lock failure inline so badframe is only reached with a valid lock.
Signed-off-by: Matt Turner <[email protected]> Cc: [email protected] Reviewed-by: Helge Deller <[email protected]> Signed-off-by: Helge Deller <[email protected]> (cherry picked from commit 54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67) Signed-off-by: Michael Tokarev <[email protected]> diff --git a/linux-user/xtensa/signal.c b/linux-user/xtensa/signal.c index fb1a3b86c1..49a4d4bb53 100644 --- a/linux-user/xtensa/signal.c +++ b/linux-user/xtensa/signal.c @@ -356,7 +356,8 @@ long do_rt_sigreturn(CPUXtensaState *env) trace_user_do_rt_sigreturn(env, frame_addr); if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { - goto badframe; + force_sig(TARGET_SIGSEGV); + return -QEMU_ESIGRETURN; } target_to_host_sigset(&set, &frame->uc.tuc_sigmask); set_sigmask(&set); -- 2.47.3
