From: Chen Gang S <gang.c...@sunrus.com.cn> When failure occurs during locking of vec[i], we also need to unlock all already locked vec[i] in failure processing code block before return.
Code in unlock_user() checks vec[i].iov_base for NULL, so there's no need not check it . If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just skip it, so can still use "while (--i >= 0)" loop condition. Signed-off-by: Chen Gang <gang.chen.5...@gmail.com> Reviewed-by: Peter Maydell <peter.mayd...@linaro.org> Signed-off-by: Michael Tokarev <m...@tls.msk.ru> --- linux-user/syscall.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index d4398b9..7b6f482 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -1883,6 +1883,11 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, return vec; fail: + while (--i >= 0) { + if (tswapal(target_vec[i].iov_len) > 0) { + unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0); + } + } unlock_user(target_vec, target_addr, 0); fail2: free(vec); -- 2.1.4