justin/jsix
1
1
Fork 0
mirror of https://github.com/justinian/jsix.git synced 2025-12-10 00:14:32 -08:00
Code Issues Packages Projects Releases Wiki Activity

[kernel] Fix memory clobbering from endpoint

Browse Source 
The endpoint receive syscalls can block and then write to userspace
memory. Since the current address space may be different after blocking,
make sure to only actually write to the user memory after returning to
the syscall handler - pass values that are on the syscall handler stack
deeper into the kernel.
This commit is contained in:
Justin C. Miller
2021-01-06 23:16:16 -08:00
parent 14ed6af433
commit d1c0723b44
2 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/include/j6/types.h
View File

@@ -18,6 +18,7 @@ typedef uint64_t j6_signal_t;
typedef uint64_t j6_tag_t;
#define j6_tag_system_flag 0x8000000000000000
#define j6_tag_invalid 0x0000000000000000
/// If all high bits except the last 16 are set, then the tag represents
/// an IRQ.

14
src/kernel/syscalls/endpoint.cpp
View File

@@ -35,7 +35,12 @@ endpoint_receive(j6_handle_t handle, j6_tag_t *tag, size_t *len, void *data)
endpoint *e = get_handle<endpoint>(handle);
if (!e) return j6_err_invalid_arg;
return e->receive(tag, len, data);
j6_tag_t out_tag = j6_tag_invalid;
size_t out_len = 0;
j6_status_t s = e->receive(&out_tag, &out_len, data);
*tag = out_tag;
*len = out_len;
return s;
}
j6_status_t
@@ -51,7 +56,12 @@ endpoint_sendrecv(j6_handle_t handle, j6_tag_t *tag, size_t *len, void *data)
if (status != j6_status_ok)
return status;
return e->receive(tag, len, data);
j6_tag_t out_tag = j6_tag_invalid;
size_t out_len = 0;
j6_status_t s = e->receive(&out_tag, &out_len, data);
*tag = out_tag;
*len = out_len;
return s;
}
} // namespace syscalls