linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn
If lock_user_struct fails, frame is uninitialized but the badframe label unconditionally calls unlock_user_struct on it. Handle the lock failure inline so badframe is only reached with a valid lock. Signed-off-by: Matt Turner <mattst88@gmail.com> Cc: qemu-stable@nongnu.org Reviewed-by: Helge Deller <deller@gmx.de> Signed-off-by: Helge Deller <deller@gmx.de>
Matt Turner committed
Jun 18, 2026 at 09:33 UTC
54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67
1 file changed
+2
-1
linux-user/xtensa/signal.c
+2
-1
@@ -355,7 +355,8 @@ long do_rt_sigreturn(CPUXtensaState *env)
355
356
trace_user_do_rt_sigreturn(env, frame_addr);
357
if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) {
358
- goto badframe;
358
+ force_sig(TARGET_SIGSEGV);
359
+ return -QEMU_ESIGRETURN;
360
}
361
target_to_host_sigset(&set, &frame->uc.tuc_sigmask);
362
set_sigmask(&set);