From 5d2fa8ebb4dae0057ed9baab617971dcd5ea493f Mon Sep 17 00:00:00 2001 From: Tom Musta Date: Tue, 12 Aug 2014 13:53:33 -0500 Subject: [PATCH] linux-user: Dereference Pointer Argument to ipc/semctl Sys Call When the ipc system call is used to wrap a semctl system call, the ptr argument to ipc needs to be dereferenced prior to passing it to the semctl handler. This is because the fourth argument to semctl is a union and not a pointer to a union. Signed-off-by: Tom Musta Signed-off-by: Riku Voipio --- linux-user/syscall.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index fba7fd2..08fdd94 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -3140,9 +3140,15 @@ static abi_long do_ipc(unsigned int call, int first, ret = get_errno(semget(first, second, third)); break; - case IPCOP_semctl: - ret = do_semctl(first, second, third, (union target_semun)(abi_ulong) ptr); + case IPCOP_semctl: { + /* The semun argument to semctl is passed by value, so dereference the + * ptr argument. */ + abi_ulong atptr; + get_user_ual(atptr, (abi_ulong)ptr); + ret = do_semctl(first, second, third, + (union target_semun)(abi_ulong) atptr); break; + } case IPCOP_msgget: ret = get_errno(msgget(first, second)); -- 2.7.4