aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthew D Fleming <mdf@FreeBSD.org>2010-12-15 19:30:44 +0000
committerMatthew D Fleming <mdf@FreeBSD.org>2010-12-15 19:30:44 +0000
commite0f389c8d327d1d01fc31bcc974e7205d2c2c92b (patch)
tree3729f1e97aeb72e429a14afee3b4a72ab04f7e1d
parent2d843e7d34cecb4f6020e5b32c40cadab3b96c82 (diff)
downloadsrc-e0f389c8d327d1d01fc31bcc974e7205d2c2c92b.tar.gz
src-e0f389c8d327d1d01fc31bcc974e7205d2c2c92b.zip
One of the compat32 functions was copying in a raw timespec, instead of
a 32-bit one. This can cause weird timeout issues, as the copying reads garbage from the user. Code by: Deepak Veliath <deepak dot veliath at isilon dot com> MFC after: 1 week
Notes
Notes: svn path=/head/; revision=216463
-rw-r--r--sys/kern/kern_umtx.c3
1 files changed, 1 insertions, 2 deletions
diff --git a/sys/kern/kern_umtx.c b/sys/kern/kern_umtx.c
index e7b9b32ddb8b..77e47e56b872 100644
--- a/sys/kern/kern_umtx.c
+++ b/sys/kern/kern_umtx.c
@@ -3411,8 +3411,7 @@ __umtx_op_rw_rdlock_compat32(struct thread *td, struct _umtx_op_args *uap)
if (uap->uaddr2 == NULL) {
error = do_rw_rdlock(td, uap->obj, uap->val, 0);
} else {
- error = copyin(uap->uaddr2, &timeout,
- sizeof(timeout));
+ error = copyin_timeout32(uap->uaddr2, &timeout);
if (error != 0)
return (error);
if (timeout.tv_nsec >= 1000000000 ||