target/hexagon: fix semihosting ACCESS filename handling

HEX_SYS_ACCESS wrote a NUL byte past its fixed-size filename buffer when
the guest string filled it. Use lock_user_string() to avoid the out-of-bounds
write.

Fixes: 7711fdba88 ("target/hexagon: add main arch-specific semihosting operations")
Resolves: Coverity CID 1685942
Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ2aLSe-t6iw@mail.gmail.com/
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>

target/hexagon/hexswi.c

@@ -630,26 +630,24 @@ static void sim_handle_trap0(CPUHexagonState *env)
 
     case HEX_SYS_ACCESS:
     {
-        char filename[BUFSIZ];
+        char *filename;
         uint32_t FileNameAddr;
         uint32_t BufferMode;
-        int rc;
-
-        int i = 0;
+        int rc, err;
 
         if (get_user_u32(FileNameAddr, swi_info) ||
             get_user_u32(BufferMode, swi_info + 4)) {
             goto do_fault;
         }
-        do {
-            if (get_user_u8(filename[i], FileNameAddr + i)) {
-                goto do_fault;
-            }
-            i++;
-        } while ((i < BUFSIZ) && (filename[i - 1]));
-        filename[i] = 0;
+        filename = lock_user_string(FileNameAddr);
+        if (!filename) {
+            semi_cb(cs, -1, EFAULT);
+            break;
+        }
         rc = access(filename, BufferMode);
-        semi_cb(cs, rc,  rc == 0 ? 0 : errno);
+        err = errno;
+        unlock_user(filename, FileNameAddr, 0);
+        semi_cb(cs, rc,  rc == 0 ? 0 : err);
     }
     break;