Changeset c377c5e4 in mainline

Timestamp:

2018-03-11T07:35:05Z (7 years ago)

Author:

Jakub Jermar <jakub@…>

Children:

813fc8c

Parents:

2736ef9b

git-author:

Jakub Jermar <jakub@…> (2018-03-04 19:36:57)

git-committer:

Jakub Jermar <jakub@…> (2018-03-11 07:35:05)

Message:

Allow only connecting phones to connect

If a phone is not in the IPC_PHONE_CONNECTING state, refuse to connect
it. An attempt to do so might be a result of a race between the kernel
expecting a connecting phone under a known handle and the user fiddling
with phone capabilites handles from userspace.

Location:

kernel/generic/src/ipc

Files:

• ipc.c (modified) (2 diffs)
• ipcrsc.c (modified) (1 diff)

kernel/generic/src/ipc/ipc.c

@@ -161 +161 @@
 bool ipc_phone_connect(phone_t *phone, answerbox_t *box)
 {
-        bool active;
+        bool connected;
 
         mutex_lock(&phone->lock);
         irq_spinlock_lock(&box->lock, true);
 
-        active = box->active;
-        if (active) {
+        connected = box->active && (phone->state == IPC_PHONE_CONNECTING);
+        if (connected) {
                 phone->state = IPC_PHONE_CONNECTED;
                 phone->callee = box;
@@ -177 +177 @@
         mutex_unlock(&phone->lock);
 
-        if (!active) {
+        if (!connected) {
                 /* We still have phone->kobject's reference; drop it */
                 kobject_put(phone->kobject);
         }
 
-        return active;
+        return connected;
 }
 

kernel/generic/src/ipc/ipcrsc.c

@@ -216 +216 @@
                 return false;
 
-        if (phone_obj->phone->state != IPC_PHONE_CONNECTING) {
-                /*
-                 * This looks like another phone. The one we were expecting
-                 * under this handle must be in the IPC_PHONE_CONNECTING state.
-                 */
-                kobject_put(phone_obj);
-                return false;
-        }
-
         /* Hand over phone_obj reference to the answerbox */
         return ipc_phone_connect(phone_obj->phone, box);