From patchwork Tue Apr 19 06:09:47 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mike McCormack X-Patchwork-Id: 91920 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [140.186.70.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id A7E25B7012 for ; Tue, 19 Apr 2011 16:09:01 +1000 (EST) Received: from localhost ([::1]:37143 helo=lists2.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QC47N-0006d9-G9 for incoming@patchwork.ozlabs.org; Tue, 19 Apr 2011 02:08:57 -0400 Received: from eggs.gnu.org ([140.186.70.92]:41627) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QC47G-0006d4-Gn for qemu-devel@nongnu.org; Tue, 19 Apr 2011 02:08:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QC47E-0000FM-IZ for qemu-devel@nongnu.org; Tue, 19 Apr 2011 02:08:50 -0400 Received: from mailout3.samsung.com ([203.254.224.33]:23436) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QC47E-0000FG-6n for qemu-devel@nongnu.org; Tue, 19 Apr 2011 02:08:48 -0400 Received: from epmmp2 (mailout3.samsung.com [203.254.224.33]) by mailout3.samsung.com (Oracle Communications Messaging Exchange Server 7u4-19.01 64bit (built Sep 7 2010)) with ESMTP id <0LJV00AVXYEI6GD0@mailout3.samsung.com> for qemu-devel@nongnu.org; Tue, 19 Apr 2011 15:08:42 +0900 (KST) Received: from TNRNDGASPAPP1.tn.corp.samsungelectronics.net ([165.213.149.150]) by mmp2.samsung.com (iPlanet Messaging Server 5.2 Patch 2 (built Jul 14 2004)) with ESMTPA id <0LJV00C5GYEJLO@mmp2.samsung.com> for qemu-devel@nongnu.org; Tue, 19 Apr 2011 15:08:43 +0900 (KST) Received: from [10.254.103.179] ([10.254.103.179]) by TNRNDGASPAPP1.tn.corp.samsungelectronics.net with Microsoft SMTPSVC(6.0.3790.4675); Tue, 19 Apr 2011 15:08:42 +0900 Date: Tue, 19 Apr 2011 15:09:47 +0900 From: Mike McCormack To: riku.voipio@iki.fi Message-id: <4DAD272B.7060006@samsung.com> MIME-version: 1.0 Content-type: text/plain; charset=ISO-8859-1 Content-transfer-encoding: 7BIT User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.2.14) Gecko/20110223 Thunderbird/3.1.8 X-OriginalArrivalTime: 19 Apr 2011 06:08:42.0840 (UTC) FILETIME=[3C0F3D80:01CBFE58] X-detected-operating-system: by eggs.gnu.org: Solaris 10 (1203?) X-Received-From: 203.254.224.33 Cc: Rafal Krypa , vapier@gentoo.org, qemu-devel@nongnu.org, stefanha@linux.vnet.ibm.com Subject: [Qemu-devel] [PATCH 1/2] Fix buffer overrun in sched_getaffinity X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Zeroing of the cpu array should start from &cpus[kernel_ret] not &cpus[num_zeros_to_fill]. This fixes a crash in EFL's edje_cc running under qemu-arm. Signed-off-by: Mike McCormack Reviewed-by: Stefan Hajnoczi Acked-by: Mike Frysinger --- linux-user/syscall.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index bb0999d..1cda10a 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -6389,7 +6389,7 @@ abi_long do_syscall(void *cpu_env, int num, abi_long arg1, unsigned long zero = arg2 - ret; p = alloca(zero); memset(p, 0, zero); - if (copy_to_user(arg3 + zero, p, zero)) { + if (copy_to_user(arg3 + ret, p, zero)) { goto efault; } arg2 = ret;