On Thu, Aug 27, 2015 at 07:06:24PM +0100, Peter Maydell wrote: > This definitely looks like a bug, but I don't think this is > a sufficient fix, because if DEBUG_REMAP is defined then the > locked-memory which the target_cmsghdr* is in is not a > simple g2h() away from the host pointer. > > What you need to do is change target_to_host_cmsg and > host_to_target_cmsg so that when at the top of the function > we do: > target_cmsg_addr = tswapal(target_msgh->msg_control); > target_cmsg = lock_user(VERIFY_READ, target_cmsg_addr, msg_controllen, 1);
After following your advice, I found two more bugs in related code, which I had to fix. I probably missed something, but my test case (wine), which receives two headers via a single recvmsg call, is now working properly. Perhaps an isolated test case would be nice. I'll send my new patch soon. Regards, Jonathan Neuschäfer
