From 7eff518b6c91bdd62710dd9868ec7a17bd6f1434 Mon Sep 17 00:00:00 2001 From: Chen Gang S Date: Fri, 23 Jan 2015 18:01:09 +0800 Subject: linux-user/syscall.c: lock_iovec: unlock vec[i] in failure processing code block When failure occurs during locking of vec[i], we also need to unlock all already locked vec[i] in failure processing code block before return. Code in unlock_user() checks vec[i].iov_base for NULL, so there's no need not check it . If error is EFAULT when "i == 0", vec[i].iov_base is NULL, we can just skip it, so can still use "while (--i >= 0)" loop condition. Signed-off-by: Chen Gang Reviewed-by: Peter Maydell Signed-off-by: Michael Tokarev --- linux-user/syscall.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'linux-user') diff --git a/linux-user/syscall.c b/linux-user/syscall.c index d4398b9c56..7b6f482970 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -1883,6 +1883,11 @@ static struct iovec *lock_iovec(int type, abi_ulong target_addr, return vec; fail: + while (--i >= 0) { + if (tswapal(target_vec[i].iov_len) > 0) { + unlock_user(vec[i].iov_base, tswapal(target_vec[i].iov_base), 0); + } + } unlock_user(target_vec, target_addr, 0); fail2: free(vec); -- cgit v1.2.1