diff options
| author | Matt Turner <mattst88@gmail.com> | 2026-06-18 09:33:53 -0400 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2026-06-24 16:34:52 +0300 |
| commit | a35a6ea811906cd1139b15158741c2cc41684a4a (patch) | |
| tree | aa18d5fc699cceb7f9cf6fba6e051f4e818671db | |
| parent | 325a52f543a3887ef1bf4318208f8116ae68c451 (diff) | |
| download | qemu-a35a6ea811906cd1139b15158741c2cc41684a4a.tar.gz qemu-a35a6ea811906cd1139b15158741c2cc41684a4a.zip | |
linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
If lock_user_struct fails, frame is uninitialized but the badframe
label unconditionally calls unlock_user_struct on it. Handle the
lock failure inline so badframe is only reached with a valid lock.
Signed-off-by: Matt Turner <mattst88@gmail.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
(cherry picked from commit 54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
| -rw-r--r-- | linux-user/xtensa/signal.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/linux-user/xtensa/signal.c b/linux-user/xtensa/signal.c index e3f9da322b..4990c50045 100644 --- a/linux-user/xtensa/signal.c +++ b/linux-user/xtensa/signal.c @@ -355,7 +355,8 @@ long do_rt_sigreturn(CPUXtensaState *env) trace_user_do_rt_sigreturn(env, frame_addr); if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { - goto badframe; + force_sig(TARGET_SIGSEGV); + return -QEMU_ESIGRETURN; } target_to_host_sigset(&set, &frame->uc.tuc_sigmask); set_sigmask(&set); |