On Fri, 16 Oct 2026 at 15:30, Brian Cain <[email protected]> wrote: > > HEX_SYS_OPEN copied guest bytes into a fixed-size buffer until it found a > NUL. A missing terminator could overrun that buffer. Use lock_user() with > the ABI filename length and validate its terminating NUL before opening it. > > Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting > operations") > Link: > https://lore.kernel.org/all/cafeaca9mos6vfhf2uhz8z4cdvab+7dy6hjb2emyz2alse-t...@mail.gmail.com/ > Suggested-by: Peter Maydell <[email protected]> > Signed-off-by: Brian Cain <[email protected]> > --- > target/hexagon/hexswi.c | 29 ++++++++++++----------------- > 1 file changed, 12 insertions(+), 17 deletions(-) >
With the unlock call from patch 1 moved into here Reviewed-by: Peter Maydell <[email protected]> thanks -- PMM
