Changeset 27526e87 in mainline

Timestamp:

2008-09-09T19:24:42Z (16 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

0320823

Parents:

e40e3007

Message:

Kernel's ipc_data_t and uspace's ipc_call_t must be in sync.

This commit fixes a problem introduced in revision 3362, when
ipc_data_t was enlarged by the caller_phone member. This resulted
in sys_ipc_wait_for_call() passing larger structure to uspace
than requested, leading to a random damage of userspace memory.

Location:

kernel/generic

Files:

• include/ipc/ipc.h (modified) (2 diffs)
• src/ipc/ipc.c (modified) (2 diffs)

kernel/generic/include/ipc/ipc.h

@@ -261 +261 @@
         unative_t args[IPC_CALL_LEN];
         phone_t *phone;
+} ipc_data_t;
+
+typedef struct {
+        link_t link;
+
+        int flags;
+
+        /** Identification of the caller. */
+        struct task *sender;
+        /** The caller box is different from sender->answerbox for synchronous
+         *  calls. */
+        answerbox_t *callerbox;
+
+        /** Private data to internal IPC. */
+        unative_t priv;
+
+        /** Data passed from/to userspace. */
+        ipc_data_t data;
+
+        /** Buffer for IPC_M_DATA_WRITE and IPC_M_DATA_READ. */
+        uint8_t *buffer;
+
         /*
          * The forward operation can masquerade the caller phone. For those
@@ -267 +289 @@
          */
         phone_t *caller_phone;
-} ipc_data_t;
-
-typedef struct {
-        link_t link;
-
-        int flags;
-
-        /** Identification of the caller. */
-        struct task *sender;
-        /** The caller box is different from sender->answerbox for synchronous
-         *  calls. */
-        answerbox_t *callerbox;
-
-        /** Private data to internal IPC. */
-        unative_t priv;
-
-        /** Data passed from/to userspace. */
-        ipc_data_t data;
-
-        /** Buffer for IPC_M_DATA_WRITE and IPC_M_DATA_READ. */
-        uint8_t *buffer;
 } call_t;
 

kernel/generic/src/ipc/ipc.c

@@ -202 +202 @@
 
         if (call->flags & IPC_CALL_FORWARDED) {
-                if (call->data.caller_phone) {
+                if (call->caller_phone) {
                         /* Demasquerade the caller phone. */
-                        call->data.phone = call->data.caller_phone;
+                        call->data.phone = call->caller_phone;
                 }
         }
@@ -361 +361 @@
 
         if (mode & IPC_FF_ROUTE_FROM_ME) {
-                if (!call->data.caller_phone)
-                        call->data.caller_phone = call->data.phone;
+                if (!call->caller_phone)
+                        call->caller_phone = call->data.phone;
                 call->data.phone = newphone;
         }