The llseek syscall takes two 32-bit arguments, offset_high and offset_low, which must be combined to form a single 64-bit offset. Unfortunately we were combining them with (uint64_t)arg2 << 32) | arg3 and arg3 is a signed type; this meant that when promoting arg3 to a 64-bit type it would be sign-extended. The effect was that if the offset happened to have bit 31 set then this bit would get sign-extended into all of bits 63..32. Explicitly cast arg3 to abi_ulong to avoid the erroneous sign extension.
Reported-by: Chanho Park <parkc...@gmail.com> Signed-off-by: Peter Maydell <peter.mayd...@linaro.org> --- Long-standing bug and we're quite close to 2.7 but the fix is trivial so if somebody would like to review it I think we could put it in... linux-user/syscall.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index ebdb753..b4e21d3 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -9406,7 +9406,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, { int64_t res; #if !defined(__NR_llseek) - res = lseek(arg1, ((uint64_t)arg2 << 32) | arg3, arg5); + res = lseek(arg1, ((uint64_t)arg2 << 32) | (abi_ulong)arg3, arg5); if (res == -1) { ret = get_errno(res); } else { -- 2.7.4