Commit 38d840e6790c29f5928d8e62711b9f721b58b3dd
1 parent
a516e72d
linuw-user fix: read() and acct() on NULL arguments
Returning efault in these cases is not correct. Originally proposed by Thayne Harbaugh in 2007: http://www.mail-archive.com/qemu-devel@nongnu.org/msg14658.html Signed-off-by: Riku Voipio <riku.voipio@iki.fi> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6481 c046a42c-6fe2-441c-8c8c-71466251a162
Showing
1 changed file
with
16 additions
and
8 deletions
linux-user/syscall.c
... | ... | @@ -3437,10 +3437,14 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, |
3437 | 3437 | ret = 0; /* avoid warning */ |
3438 | 3438 | break; |
3439 | 3439 | case TARGET_NR_read: |
3440 | - if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0))) | |
3441 | - goto efault; | |
3442 | - ret = get_errno(read(arg1, p, arg3)); | |
3443 | - unlock_user(p, arg2, ret); | |
3440 | + if (arg3 == 0) | |
3441 | + ret = 0; | |
3442 | + else { | |
3443 | + if (!(p = lock_user(VERIFY_WRITE, arg2, arg3, 0))) | |
3444 | + goto efault; | |
3445 | + ret = get_errno(read(arg1, p, arg3)); | |
3446 | + unlock_user(p, arg2, ret); | |
3447 | + } | |
3444 | 3448 | break; |
3445 | 3449 | case TARGET_NR_write: |
3446 | 3450 | if (!(p = lock_user(VERIFY_READ, arg2, arg3, 1))) |
... | ... | @@ -3941,10 +3945,14 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, |
3941 | 3945 | goto unimplemented; |
3942 | 3946 | #endif |
3943 | 3947 | case TARGET_NR_acct: |
3944 | - if (!(p = lock_user_string(arg1))) | |
3945 | - goto efault; | |
3946 | - ret = get_errno(acct(path(p))); | |
3947 | - unlock_user(p, arg1, 0); | |
3948 | + if (arg1 == 0) { | |
3949 | + ret = get_errno(acct(NULL)); | |
3950 | + } else { | |
3951 | + if (!(p = lock_user_string(arg1))) | |
3952 | + goto efault; | |
3953 | + ret = get_errno(acct(path(p))); | |
3954 | + unlock_user(p, arg1, 0); | |
3955 | + } | |
3948 | 3956 | break; |
3949 | 3957 | #ifdef TARGET_NR_umount2 /* not on alpha */ |
3950 | 3958 | case TARGET_NR_umount2: | ... | ... |