From 54e08dbe8f2aeca57e3b1a5eab09a9fec88c1c67 Mon Sep 17 00:00:00 2001 From: Matt Turner Date: Thu, 18 Jun 2026 09:33:53 -0400 Subject: [PATCH] linux-user/xtensa: fix unlock of uninitialized frame pointer on sigreturn If lock_user_struct fails, frame is uninitialized but the badframe label unconditionally calls unlock_user_struct on it. Handle the lock failure inline so badframe is only reached with a valid lock. Signed-off-by: Matt Turner Cc: qemu-stable@nongnu.org Reviewed-by: Helge Deller Signed-off-by: Helge Deller --- linux-user/xtensa/signal.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/linux-user/xtensa/signal.c b/linux-user/xtensa/signal.c index e3f9da322b..4990c50045 100644 --- a/linux-user/xtensa/signal.c +++ b/linux-user/xtensa/signal.c @@ -355,7 +355,8 @@ long do_rt_sigreturn(CPUXtensaState *env) trace_user_do_rt_sigreturn(env, frame_addr); if (!lock_user_struct(VERIFY_READ, frame, frame_addr, 1)) { - goto badframe; + force_sig(TARGET_SIGSEGV); + return -QEMU_ESIGRETURN; } target_to_host_sigset(&set, &frame->uc.tuc_sigmask); set_sigmask(&set);