Re: [Qemu-devel] [PATCH v3] linux-user: fix QEMU_STRACE=1 segfault

[Peter Maydell]

On 21 November 2011 11:04, Alexander Graf <address@hidden> wrote:
>  static void
>  print_syscall_ret_addr(const struct syscallname *name, abi_long ret)
>  {
> -if( ret == -1 ) {
> -        gemu_log(" = -1 errno=%d (%s)\n", errno, target_strerror(errno));
> +    char *errstr = NULL;
> +
> +    if (ret == -1) {
> +        errstr = target_strerror(errno);
> +    }
> +    if ((ret == -1) && errstr) {
> +        gemu_log(" = -1 errno=%d (%s)\n", errno, errstr);
>     } else {
>         gemu_log(" = 0x" TARGET_ABI_FMT_lx "\n", ret);
>     }

Looking more closely at this function I'm pretty sure it's wrong.
We shouldn't be calling target_strerror() on errno, because the
syscall.c code has already put the errno into ret as -thing.
This code should look exactly like the default case in
print_syscall_ret() except that the format string used should
be TARGET_ABI_FMT_lx rather than TARGET_ABI_FMT_ld.

You can see the problem if you compile and run this test
program:

#include <sys/mman.h>
int main(void)
{
   mmap(0, 0xc0000000, PROT_READ, MAP_ANONYMOUS, -1, 0);
   return 0;
}

Run under native strace it prints:
mmap2(NULL, 3221225472, PROT_READ, MAP_FILE|MAP_ANONYMOUS, -1, 0) = -1
ENOMEM (Cannot allocate memory)

Run under i386-linux-user/qemu-i386 -strace it prints:
5892 mmap2(NULL,-1073741824,PROT_READ,MAP_ANONYMOUS,-1,0) = 0xfffffff4

because we haven't noticed that that return value is an errno.

-- PMM