From 97c1bb79fc85bcb43e99ebdac67a4e655200e841 Mon Sep 17 00:00:00 2001 From: Brian Cain Date: Mon, 19 Oct 2026 19:03:41 -0700 Subject: [PATCH] target/hexagon: fix semihosting STAT filename handling HEX_SYS_STAT could pass an unterminated local filename buffer to stat() when the guest string filled it. Use lock_user_string() to map the guest string safely. Fixes: 7711fdba88b ("target/hexagon: add main arch-specific semihosting operations") Link: https://lore.kernel.org/all/CAFEAcA9MOs6VfHf2UHZ8z4cdvaB+7DY6hJb2emYZ2aLSe-t6iw@mail.gmail.com/ Suggested-by: Peter Maydell Reviewed-by: Peter Maydell Signed-off-by: Brian Cain --- target/hexagon/hexswi.c | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/target/hexagon/hexswi.c b/target/hexagon/hexswi.c index 6e83d86733..2eba6021b4 100644 --- a/target/hexagon/hexswi.c +++ b/target/hexagon/hexswi.c @@ -568,7 +568,7 @@ static void sim_handle_trap0(CPUHexagonState *env) struct stat st_buf; uint8_t *st_bufptr = (uint8_t *)&sys_stat; int rc, err = 0; - char filename[BUFSIZ]; + char *filename; target_ulong physical_filename_addr; target_ulong statBufferAddr; if (get_user_u32(physical_filename_addr, swi_info) || @@ -577,15 +577,14 @@ static void sim_handle_trap0(CPUHexagonState *env) } if (what_swi == HEX_SYS_STAT) { - int i = 0; - do { - if (get_user_u8(filename[i], physical_filename_addr + i)) { - goto do_fault; - } - i++; - } while ((i < BUFSIZ) && filename[i - 1]); + filename = lock_user_string(physical_filename_addr); + if (!filename) { + semi_cb(cs, -1, EFAULT); + break; + } rc = stat(filename, &st_buf); err = errno; + unlock_user(filename, physical_filename_addr, 0); } else { int fd = physical_filename_addr; GuestFD *gf = get_guestfd(fd);