Otherwise we get a ton of unaligned exceptions, for cases such
as compat_sys_msgrcv() which go:
p = compat_alloc_user_space(second + sizeof(struct msgbuf));
and here 'second' can for example be an arbitrary odd value.
Based upon a bug report from Jurij Smakov.
Signed-off-by: David S. Miller <davem@davemloft.net>
return (u32)(unsigned long)uptr;
}
-static __inline__ void __user *compat_alloc_user_space(long len)
+static inline void __user *compat_alloc_user_space(long len)
{
struct pt_regs *regs = current_thread_info()->kregs;
unsigned long usp = regs->u_regs[UREG_I6];
else
usp &= 0xffffffffUL;
- return (void __user *) (usp - len);
+ usp -= len;
+ usp &= ~0x7UL;
+
+ return (void __user *) usp;
}
struct compat_ipc64_perm {