From e7757252b3084c21cb8f7be6f710727c7e09f7f1 Mon Sep 17 00:00:00 2001
From: fengbojiang <fengbojiang@tencent.com>
Date: Tue, 5 Jul 2022 17:43:39 +0800
Subject: [PATCH] ioctl_va bug fix #665.

---
 tools/compat/ioctl.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tools/compat/ioctl.c b/tools/compat/ioctl.c
index 782d61649..0816f2765 100644
--- a/tools/compat/ioctl.c
+++ b/tools/compat/ioctl.c
@@ -114,7 +114,7 @@ ioctl_va(int fd, unsigned long com, void *data, int argc, ...)
     msg->ioctl.cmd = com;
     msg->ioctl.data = msg->buf_addr;
     memcpy(msg->ioctl.data, data, size);
-    msg->buf_addr += size;
+    char *buf_addr = msg->buf_addr + size;
 
     if (argc == 3) {
         if (size + clen > msg->buf_len) {
@@ -123,7 +123,6 @@ ioctl_va(int fd, unsigned long com, void *data, int argc, ...)
             return -1;
         }
         char *ptr = (char *)(msg->ioctl.data) + offset;
-        char *buf_addr = msg->buf_addr;
         memcpy(ptr, &buf_addr, sizeof(char *));
         memcpy(buf_addr, cpy_mem, clen);
     }
@@ -152,7 +151,7 @@ ioctl_va(int fd, unsigned long com, void *data, int argc, ...)
         if (com & IOC_OUT) {
             memcpy(data, retmsg->ioctl.data, size);
             if (argc == 3) {
-                memcpy(cpy_mem, retmsg->buf_addr, clen);
+                memcpy(cpy_mem, buf_addr, clen);
                 char *ptr = (char *)data + offset;
                 memcpy(ptr, &cpy_mem, sizeof(void *));
             }