The code in setup_rt_frame reads two words at haddr, but locks only one.
This patch fixes it to lock both.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Acked-by: Helge Deller <deller@gmx.de>
Cc: qemu-stable@nongnu.org
Signed-off-by: Helge Deller <deller@gmx.de>
target_ulong *fdesc, dest;
haddr &= -4;
- if (!lock_user_struct(VERIFY_READ, fdesc, haddr, 1)) {
+ fdesc = lock_user(VERIFY_READ, haddr, 2 * sizeof(target_ulong), 1);
+ if (!fdesc) {
goto give_sigsegv;
}
__get_user(dest, fdesc);
__get_user(env->gr[19], fdesc + 1);
- unlock_user_struct(fdesc, haddr, 1);
+ unlock_user(fdesc, haddr, 0);
haddr = dest;
}
env->iaoq_f = haddr;