Re: [Qemu-devel] [PATCH] linux-user: fix ipc(SEMCTL, ...) argument handling

[Peter Maydell]

On 23 June 2014 23:36, Paul Burton <address@hidden> wrote:
> Actually no, I don't think you're right about that afterall. The
> argument union itself is never modified. I imagine if it were then it
> would be painful in the case of the semctl syscall where the union is
> passed directly as an argument, rather than as a pointer as it is for
> the ipc syscall.
>
> What may be modified is the data pointed to by the pointers within union
> semun. That is already handled by do_semctl & the translate functions it
> calls.

Except if you look at do_semctl you see code like:
        case GETVAL:
        case SETVAL:
            arg.val = tswap32(target_su.val);
            ret = get_errno(semctl(semid, semnum, cmd, arg));
            target_su.val = tswap32(arg.val);
            break;

which clearly is just modifying fields in the target_semun union.
So something's wrong (probably that code)...

thanks
-- PMM