fix dangling pointers in x32 syscall timespec fixup code

the lifetime of compound literals is the block in which they appear.
the temporary struct __timespec_kernel objects created as compound
literals no longer existed at the time their addresses were passed to
the kernel.

1 files changed, 7 insertions, 3 deletions

diff --git a/arch/x32/src/syscall_cp_fixup.c b/arch/x32/src/syscall_cp_fixup.c
index 07d39b52..deb01ee9 100644
--- a/arch/x32/src/syscall_cp_fixup.c
+++ b/arch/x32/src/syscall_cp_fixup.c
@@ -9,14 +9,18 @@ long __syscall_cp_internal(volatile void*, long long, long long, long long, long
 struct __timespec { long long tv_sec; long tv_nsec; };
 struct __timespec_kernel { long long tv_sec; long long tv_nsec; };
 #define __tsc(X) ((struct __timespec*)(unsigned long)(X))
-#define __fixup(X) do { if(X) X = (unsigned long) (&(struct __timespec_kernel) \
-                   { .tv_sec = __tsc(X)->tv_sec, .tv_nsec = __tsc(X)->tv_nsec}); } while(0)
+#define __fixup(X) do { if(X) { \
+	ts->tv_sec = __tsc(X)->tv_sec; \
+	ts->tv_nsec = __tsc(X)->tv_nsec; \
+	(X) = (unsigned long)ts; } } while(0)
 
 #ifdef SHARED
 __attribute__((__visibility__("hidden")))
 #endif
 long __syscall_cp_asm (volatile void * foo, long long n, long long a1, long long a2, long long a3,
-	                     long long a4, long long a5, long long a6) {
+	                     long long a4, long long a5, long long a6)
+{
+	struct __timespec_kernel ts[1];
 	switch (n) {
 	case SYS_mq_timedsend: case SYS_mq_timedreceive: case SYS_pselect6:
 		__fixup(a5);