From aecc88616a64a4e0a1ae0d6986de0054ea9f37d2 Mon Sep 17 00:00:00 2001 From: Alexander Graf Date: Mon, 10 Nov 2014 21:33:03 +0100 Subject: linux-user: Fix up timer id handling When creating a timer handle, we give the timer id a special magic offset of 0xcafe0000. However, we never mask that offset out of the timer id before we start using it to dereference our timer array. So we always end up aborting timer operations because the timer id is out of bounds. This was not an issue before my patch e52a99f756e ("linux-user: Simplify timerid checks on g_posix_timers range") because before we would blindly mask anything above the first 16 bits. This patch simplifies the code around timer id creation by introducing a proper target_timer_id typedef that is s32, just like Linux has it. It also changes the magic offset to a value that makes all timer ids be positive. Reported-by: Tom Musta Signed-off-by: Alexander Graf Reviewed-by: Peter Maydell Reviewed-by: Tom Musta Tested-by: Tom Musta Signed-off-by: Riku Voipio --- linux-user/syscall_defs.h | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) (limited to 'linux-user/syscall_defs.h') diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h index c9e6323905..ebb3be1196 100644 --- a/linux-user/syscall_defs.h +++ b/linux-user/syscall_defs.h @@ -2564,10 +2564,7 @@ struct target_ucred { #endif - -struct target_timer_t { - abi_ulong ptr; -}; +typedef int32_t target_timer_t; #define TARGET_SIGEV_MAX_SIZE 64 -- cgit v1.2.3-55-g7522