FreeBSD syscall: aio_error fails with EINVAL if the aiocb pointer is not accessible.

diff --git a/coregrind/m_syswrap/syswrap-freebsd.c b/coregrind/m_syswrap/syswrap-freebsd.c
index 43c242806edb4b2491eeb2ae3984c7686c42f160..a9efabe2e5661035717d0b222010f6a17a1d6240 100644 (file)
--- a/coregrind/m_syswrap/syswrap-freebsd.c
+++ b/coregrind/m_syswrap/syswrap-freebsd.c
@@ -3024,6 +3024,11 @@ PRE(sys_aio_error)
    PRINT("sys_aio_error ( %#" FMT_REGWORD "x )", ARG1);
    PRE_REG_READ1(ssize_t, "aio_error", struct aiocb *, iocb);
    PRE_MEM_READ("aio_error(iocb)", ARG1, sizeof(struct vki_aiocb));
+   if (ARG1) {
+      if (!ML_(safe_to_deref)((struct vki_aiocb *)ARG1, sizeof(struct vki_aiocb))) {
+         SET_STATUS_Failure(VKI_EINVAL);
+      }
+   }
 }
 
 // SYS_yield   321

diff --git a/memcheck/tests/freebsd/scalar.c b/memcheck/tests/freebsd/scalar.c
index 2cdc2241cf72ceb16815643fe7b9463c0e168a6b..eb49e01ca23ba84c1e7c2f15317cf036015e6161 100644 (file)
--- a/memcheck/tests/freebsd/scalar.c
+++ b/memcheck/tests/freebsd/scalar.c
@@ -1061,7 +1061,7 @@ int main(void)
 
    /* SYS_aio_error               317 */
    GO(SYS_aio_error, "1s 1m");
-   SY(SYS_aio_error, x0+1); SUCC;
+   SY(SYS_aio_error, x0+1); FAIL;
 
    /* freebsd 6 aio_read          318 */