setup_frame() doesn't set correctly the address of the trampoline code. The offset of retcode array must be added to the stack frame address.
Signed-off-by: Laurent Vivier <laur...@vivier.eu> --- linux-user/signal.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/linux-user/signal.c b/linux-user/signal.c index 2ea3e0321f..9399f0ec47 100644 --- a/linux-user/signal.c +++ b/linux-user/signal.c @@ -6367,7 +6367,7 @@ static void setup_frame(int sig, struct target_sigaction *ka, &frame->retcode[1]); __put_user(INSN_CALLSYS, &frame->retcode[2]); /* imb() */ - r26 = frame_addr; + r26 = frame_addr + offsetof(struct target_sigframe, retcode); } unlock_user_struct(frame, frame_addr, 1); @@ -6424,7 +6424,7 @@ static void setup_rt_frame(int sig, struct target_sigaction *ka, &frame->retcode[1]); __put_user(INSN_CALLSYS, &frame->retcode[2]); /* imb(); */ - r26 = frame_addr; + r26 = frame_addr + offsetof(struct target_sigframe, retcode); } if (err) { -- 2.14.3