justin/jsix
1
1
Fork 0
mirror of https://github.com/justinian/jsix.git synced 2025-12-10 08:24:32 -08:00
Code Issues Packages Projects Releases Wiki Activity

[kernel] Fix memory clobbering from endpoint

Browse Source 
The endpoint receive syscalls can block and then write to userspace
memory. Since the current address space may be different after blocking,
make sure to only actually write to the user memory after returning to
the syscall handler - pass values that are on the syscall handler stack
deeper into the kernel.
This commit is contained in:
Justin C. Miller
2021-01-06 23:16:16 -08:00
parent 14ed6af433
commit d1c0723b44
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/kernel/syscalls/endpoint.cpp
View File

@@ -35,7 +35,12 @@ endpoint_receive(j6_handle_t handle, j6_tag_t *tag, size_t *len, void *data)
endpoint *e = get_handle<endpoint>(handle);
if (!e) return j6_err_invalid_arg;
return e->receive(tag, len, data);
j6_tag_t out_tag = j6_tag_invalid;
size_t out_len = 0;
j6_status_t s = e->receive(&out_tag, &out_len, data);
*tag = out_tag;
*len = out_len;
return s;
}
j6_status_t
@@ -51,7 +56,12 @@ endpoint_sendrecv(j6_handle_t handle, j6_tag_t *tag, size_t *len, void *data)
if (status != j6_status_ok)
return status;
return e->receive(tag, len, data);
j6_tag_t out_tag = j6_tag_invalid;
size_t out_len = 0;
j6_status_t s = e->receive(&out_tag, &out_len, data);
*tag = out_tag;
*len = out_len;
return s;
}
} // namespace syscalls