On 20 December 2012 20:58, Laurent Vivier <laur...@vivier.eu> wrote:
> The parameter "union semun" of semctl() is not a value
> but a pointer to the value.
> @@ -3161,10 +3163,16 @@ static abi_long do_ipc(unsigned int call, int first,
> ret = get_errno(semget(first, second, third));
> break;
>
> - case IPCOP_semctl:
> - ret = do_semctl(first, second, third, (union
> target_semun)(abi_ulong) ptr);
> + case IPCOP_semctl: {
> + union target_semun *target_su;
> + if (!lock_user_struct(VERIFY_READ, target_su, ptr, 1)) {
> + ret = -TARGET_EFAULT;
> + break;
> + }
> + ret = do_semctl(first, second, third, *target_su);
> + unlock_user_struct(target_su, ptr, 0);
Rather than doing the lock/unlock in both callers to do_semctl,
just pass do_semctl an abi_long and have it do the lock/unlock.
Rest of patch looks ok.
-- PMM
