target_to_host_timespec() returns an error if the memory the guest
passed us isn't actually readable.  We check for this everywhere
except the callsite in the TARGET_NR_nanosleep case, so this mistake
was caught by a Coverity heuristic.

Add the missing error checks to the calls that convert between the
host and target timespec structs.

Coverity: CID 1507104
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
Tested via the LTP nanosleep tests, but they don't actually exercise
the EFAULT codepaths...

 linux-user/syscall.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index fc37028597c..c600d5ccc0e 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -11630,10 +11630,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     case TARGET_NR_nanosleep:
         {
             struct timespec req, rem;
-            target_to_host_timespec(&req, arg1);
+            if (target_to_host_timespec(&req, arg1)) {
+                return -TARGET_EFAULT;
+            }
             ret = get_errno(safe_nanosleep(&req, &rem));
             if (is_error(ret) && arg2) {
-                host_to_target_timespec(arg2, &rem);
+                if (host_to_target_timespec(arg2, &rem)) {
+                    return -TARGET_EFAULT;
+                }
             }
         }
         return ret;
-- 
2.43.0

On 7/10/25 10:43, Peter Maydell wrote:
> target_to_host_timespec() returns an error if the memory the guest
> passed us isn't actually readable.  We check for this everywhere
> except the callsite in the TARGET_NR_nanosleep case, so this mistake
> was caught by a Coverity heuristic.
> 
> Add the missing error checks to the calls that convert between the
> host and target timespec structs.
> 
> Coverity: CID 1507104
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> Tested via the LTP nanosleep tests, but they don't actually exercise
> the EFAULT codepaths...
> 
>   linux-user/syscall.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

> 
> diff --git a/linux-user/syscall.c b/linux-user/syscall.c
> index fc37028597c..c600d5ccc0e 100644
> --- a/linux-user/syscall.c
> +++ b/linux-user/syscall.c
> @@ -11630,10 +11630,14 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
>       case TARGET_NR_nanosleep:
>           {
>               struct timespec req, rem;
> -            target_to_host_timespec(&req, arg1);
> +            if (target_to_host_timespec(&req, arg1)) {
> +                return -TARGET_EFAULT;
> +            }
>               ret = get_errno(safe_nanosleep(&req, &rem));
>               if (is_error(ret) && arg2) {
> -                host_to_target_timespec(arg2, &rem);
> +                if (host_to_target_timespec(arg2, &rem)) {
> +                    return -TARGET_EFAULT;
> +                }
>               }
>           }
>           return ret;

On 7/10/25 10:43, Peter Maydell wrote:
> target_to_host_timespec() returns an error if the memory the guest
> passed us isn't actually readable.  We check for this everywhere
> except the callsite in the TARGET_NR_nanosleep case, so this mistake
> was caught by a Coverity heuristic.
> 
> Add the missing error checks to the calls that convert between the
> host and target timespec structs.
> 
> Coverity: CID 1507104
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> Tested via the LTP nanosleep tests, but they don't actually exercise
> the EFAULT codepaths...
> 
>   linux-user/syscall.c | 8 ++++++--
>   1 file changed, 6 insertions(+), 2 deletions(-)

Queued, thanks.

r~