Fix sys_ipc() SEMCTL on sparc64.

changeset 6536a6b331d3225921c398eb7c6e4ecedb9b05e0 from mainline

Thanks to Tom Callaway for the excellent bug report and
test case.

sys_ipc() has several problems, most to due with semaphore
call handling:

1) 'err' return should be a 'long'
2) "union semun" is passed in a register on 64-bit compared
   to 32-bit which provides it on the stack and therefore
   by reference
3) Second and third arguments to SEMCTL are swapped compared
   to 32-bit.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/arch/sparc64/kernel/sys_sparc.c b/arch/sparc64/kernel/sys_sparc.c
index d108eeb0734fe2fe3586d01a8c2e2fdf5aaf25e4..0d5c50264945e7b2f91dd738cde7d30a3d1a87ea 100644 (file)
--- a/arch/sparc64/kernel/sys_sparc.c
+++ b/arch/sparc64/kernel/sys_sparc.c
@@ -436,7 +436,7 @@ out:
 asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
                        unsigned long third, void __user *ptr, long fifth)
 {
-       int err;
+       long err;
 
        /* No need for backward compatibility. We can start fresh... */
        if (call <= SEMCTL) {
@@ -453,16 +453,9 @@ asmlinkage long sys_ipc(unsigned int call, int first, unsigned long second,
                        err = sys_semget(first, (int)second, (int)third);
                        goto out;
                case SEMCTL: {
-                       union semun fourth;
-                       err = -EINVAL;
-                       if (!ptr)
-                               goto out;
-                       err = -EFAULT;
-                       if (get_user(fourth.__pad,
-                                    (void __user * __user *) ptr))
-                               goto out;
-                       err = sys_semctl(first, (int)second | IPC_64,
-                                        (int)third, fourth);
+                       err = sys_semctl(first, third,
+                                        (int)second | IPC_64,
+                                        (union semun) ptr);
                        goto out;
                }
                default: