Changeset 78ffb70 in mainline

Timestamp:

2010-12-19T14:14:47Z (14 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

be942bc, eff1f033

Parents:

40dc422

Message:

ipc_irq_register() and ipc_irq_unregister() should check for out-of-limit INRs
passed from userspace.

Location:

kernel/generic

Files:

• include/ddi/irq.h (modified) (1 diff)
• src/ddi/irq.c (modified) (2 diffs)
• src/ipc/irq.c (modified) (4 diffs)

kernel/generic/include/ddi/irq.h

@@ -189 +189 @@
 extern hash_table_t irq_uspace_hash_table;
 
+extern inr_t last_inr;
+
 extern void irq_init(size_t, size_t);
 extern void irq_initialize(irq_t *);

kernel/generic/src/ddi/irq.c

@@ -136 +136 @@
 static size_t buckets;
 
+/** Last valid INR. */
+inr_t last_inr = 0;
+
 /** Initialize IRQ subsystem.
  *
@@ -145 +148 @@
 {
         buckets = chains;
+        last_inr = inrs - 1;
+
         /*
          * Be smart about the choice of the hash table operations.

kernel/generic/src/ipc/irq.c

@@ -131 +131 @@
 /** Register an answerbox as a receiving end for IRQ notifications.
  *
- * @param box     Receiving answerbox.
- * @param inr     IRQ number.
- * @param devno   Device number.
- * @param imethod Interface and method to be associated
- *                with the notification.
- * @param ucode   Uspace pointer to top-half pseudocode.
- *
- * @return EBADMEM, ENOENT or EEXISTS on failure or 0 on success.
+ * @param box           Receiving answerbox.
+ * @param inr           IRQ number.
+ * @param devno         Device number.
+ * @param imethod       Interface and method to be associated with the
+ *                      notification.
+ * @param ucode         Uspace pointer to top-half pseudocode.
+ * @return              EOK on success or a negative error code.
  *
  */
@@ -148 +147 @@
                 (sysarg_t) devno
         };
+
+        if ((inr < 0) || (inr > last_inr))
+                return ELIMIT;
         
         irq_code_t *code;
@@ -208 +210 @@
 /** Unregister task from IRQ notification.
  *
- * @param box   Answerbox associated with the notification.
- * @param inr   IRQ number.
- * @param devno Device number.
- *
+ * @param box           Answerbox associated with the notification.
+ * @param inr           IRQ number.
+ * @param devno         Device number.
+ * @return              EOK on success or a negative error code.
  */
 int ipc_irq_unregister(answerbox_t *box, inr_t inr, devno_t devno)
@@ -219 +221 @@
                 (sysarg_t) devno
         };
+
+        if ((inr < 0) || (inr > last_inr))
+                return ELIMIT;
         
         irq_spinlock_lock(&irq_uspace_hash_table_lock, true);