aecc88616a
When creating a timer handle, we give the timer id a special magic offset
of 0xcafe0000. However, we never mask that offset out of the timer id before
we start using it to dereference our timer array. So we always end up aborting
timer operations because the timer id is out of bounds.
This was not an issue before my patch
|
||
---|---|---|
.. | ||
aarch64 | ||
alpha | ||
arm | ||
cris | ||
i386 | ||
m68k | ||
microblaze | ||
mips | ||
mips64 | ||
openrisc | ||
ppc | ||
s390x | ||
sh4 | ||
sparc | ||
sparc64 | ||
unicore32 | ||
x86_64 | ||
elfload.c | ||
errno_defs.h | ||
flat.h | ||
flatload.c | ||
ioctls.h | ||
linux_loop.h | ||
linuxload.c | ||
m68k-sim.c | ||
main.c | ||
Makefile.objs | ||
mmap.c | ||
qemu.h | ||
signal.c | ||
socket.h | ||
strace.c | ||
strace.list | ||
syscall_defs.h | ||
syscall_types.h | ||
syscall.c | ||
target_flat.h | ||
uaccess.c | ||
uname.c | ||
uname.h | ||
vm86.c |