Fix errors in unlock_user() calls:
- unlock_user() with len=1 instead of len=written
- unlock_user() with len=1 instead of len=0

Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
---
 bsd-user/bsd-misc.c | 2 +-
 bsd-user/bsd-misc.h | 2 +-
 bsd-user/bsdload.c  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/bsd-user/bsd-misc.c b/bsd-user/bsd-misc.c
index 3e1968718f..eac3edb8ac 100644
--- a/bsd-user/bsd-misc.c
+++ b/bsd-user/bsd-misc.c
@@ -95,7 +95,7 @@ abi_long host_to_target_semarray(int semid, abi_ulong target_addr,
     for (i = 0; i < nsems; i++) {
         __put_user(array[i], host_array + i);
     }
-    unlock_user(array, target_addr, 1);
+    unlock_user(array, target_addr, nsems * sizeof(unsigned short));
     return 0;
 }
 
diff --git a/bsd-user/bsd-misc.h b/bsd-user/bsd-misc.h
index 13e40d9cde..13abc7e3b1 100644
--- a/bsd-user/bsd-misc.h
+++ b/bsd-user/bsd-misc.h
@@ -211,7 +211,7 @@ static inline abi_long do_bsd___semctl(int semid, int semnum, int target_cmd,
         break;
     }
 out:
-    unlock_user(target_un, un_ptr, 1);
+    unlock_user(target_un, un_ptr, 0);
     return ret;
 }
 
diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
index 5b3c061a45..9ea3b93825 100644
--- a/bsd-user/bsdload.c
+++ b/bsd-user/bsdload.c
@@ -30,7 +30,7 @@ abi_long memcpy_to_target(abi_ulong dest, const void *src,
         return -TARGET_EFAULT;
     }
     memcpy(host_ptr, src, len);
-    unlock_user(host_ptr, dest, 1);
+    unlock_user(host_ptr, dest, len);
     return 0;
 }
 
-- 
2.51.0

On Fri, Mar 20, 2026 at 6:49 PM Nicholas Piggin <npiggin@gmail.com> wrote:

> Fix errors in unlock_user() calls:
> - unlock_user() with len=1 instead of len=written
> - unlock_user() with len=1 instead of len=0
>
> Signed-off-by: Nicholas Piggin <npiggin@gmail.com>
> ---
>  bsd-user/bsd-misc.c | 2 +-
>  bsd-user/bsd-misc.h | 2 +-
>  bsd-user/bsdload.c  | 2 +-
>  3 files changed, 3 insertions(+), 3 deletions(-)
>


Reviewed-by: Warner Losh <imp@bsdimp.com>


> diff --git a/bsd-user/bsd-misc.c b/bsd-user/bsd-misc.c
> index 3e1968718f..eac3edb8ac 100644
> --- a/bsd-user/bsd-misc.c
> +++ b/bsd-user/bsd-misc.c
> @@ -95,7 +95,7 @@ abi_long host_to_target_semarray(int semid, abi_ulong
> target_addr,
>      for (i = 0; i < nsems; i++) {
>          __put_user(array[i], host_array + i);
>      }
> -    unlock_user(array, target_addr, 1);
> +    unlock_user(array, target_addr, nsems * sizeof(unsigned short));
>      return 0;
>  }
>
> diff --git a/bsd-user/bsd-misc.h b/bsd-user/bsd-misc.h
> index 13e40d9cde..13abc7e3b1 100644
> --- a/bsd-user/bsd-misc.h
> +++ b/bsd-user/bsd-misc.h
> @@ -211,7 +211,7 @@ static inline abi_long do_bsd___semctl(int semid, int
> semnum, int target_cmd,
>          break;
>      }
>  out:
> -    unlock_user(target_un, un_ptr, 1);
> +    unlock_user(target_un, un_ptr, 0);
>      return ret;
>  }
>
> diff --git a/bsd-user/bsdload.c b/bsd-user/bsdload.c
> index 5b3c061a45..9ea3b93825 100644
> --- a/bsd-user/bsdload.c
> +++ b/bsd-user/bsdload.c
> @@ -30,7 +30,7 @@ abi_long memcpy_to_target(abi_ulong dest, const void
> *src,
>          return -TARGET_EFAULT;
>      }
>      memcpy(host_ptr, src, len);
> -    unlock_user(host_ptr, dest, 1);
> +    unlock_user(host_ptr, dest, len);
>      return 0;
>  }
>
> --
> 2.51.0
>
>