These functions wrap ioctl(). When ioctl() fails, it sets @errno. The wrappers then return that @errno negated.
Except they call accel_ioctl_end() between calling ioctl() and reading @errno. accel_ioctl_end() can clobber @errno, e.g. when a futex() system call fails. Seems unlikely, but it's a bug all the same. Fix by retrieving @errno before calling accel_ioctl_end(). Fixes: a27dd2de68f3 (KVM: keep track of running ioctls) Signed-off-by: Markus Armbruster <[email protected]> Reviewed-by: Philippe Mathieu-Daudé <[email protected]> --- accel/kvm/kvm-all.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c index f9254ae654..28006d73c5 100644 --- a/accel/kvm/kvm-all.c +++ b/accel/kvm/kvm-all.c @@ -3373,10 +3373,10 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...) trace_kvm_vm_ioctl(type, arg); accel_ioctl_begin(); ret = ioctl(s->vmfd, type, arg); - accel_ioctl_end(); if (ret == -1) { ret = -errno; } + accel_ioctl_end(); return ret; } @@ -3413,10 +3413,10 @@ int kvm_device_ioctl(int fd, unsigned long type, ...) trace_kvm_device_ioctl(fd, type, arg); accel_ioctl_begin(); ret = ioctl(fd, type, arg); - accel_ioctl_end(); if (ret == -1) { ret = -errno; } + accel_ioctl_end(); return ret; } -- 2.49.0
