In abi_long do_ioctl_dm(), after calls lock_user(), it does not call unlock_user() before go to failure return in default case.
Signed-off-by: Chen Gang <gang.chen.5...@gmail.com> --- linux-user/syscall.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/linux-user/syscall.c b/linux-user/syscall.c index a427f7a..ec9e4fc 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -3566,6 +3566,7 @@ static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd, } default: ret = -TARGET_EINVAL; + unlock_user(argptr, guest_data, 0); goto out; } unlock_user(argptr, guest_data, 0); @@ -3685,6 +3686,7 @@ static abi_long do_ioctl_dm(const IOCTLEntry *ie, uint8_t *buf_temp, int fd, break; } default: + unlock_user(argptr, guest_data, 0); ret = -TARGET_EINVAL; goto out; } -- 1.9.3