From 734e78dfcb0b1c724a336101db3edd5519ef342f Mon Sep 17 00:00:00 2001
From: Jaakko Heinonen <jh@FreeBSD.org>
Date: Wed, 21 Nov 2012 16:56:47 +0000
Subject: [PATCH] Disallow attaching preloaded memory disks via ioctl.

- The feature is dangerous because the kernel code didn't check
  validity of the memory address provided from user space.
- It seems that mdconfig(8) never really supported attaching preloaded
  memory disks.
- Preloaded memory disks are automatically attached during md(4)
  initialization. Thus there shouldn't be much use for the feature.

PR:		kern/169683
Discussed on:	freebsd-hackers
---
 sbin/mdconfig/mdconfig.c |  4 +---
 sys/dev/md/md.c          | 29 ++++++-----------------------
 2 files changed, 7 insertions(+), 26 deletions(-)

diff --git a/sbin/mdconfig/mdconfig.c b/sbin/mdconfig/mdconfig.c
index 55d1567ca970..70cefe916d19 100644
--- a/sbin/mdconfig/mdconfig.c
+++ b/sbin/mdconfig/mdconfig.c
@@ -84,7 +84,7 @@ usage(void)
 "       mdconfig -r -u unit -s size [-o [no]force]\n"
 "       mdconfig -l [-v] [-n] [-u unit]\n"
 "       mdconfig file\n");
-	fprintf(stderr, "\t\ttype = {malloc, preload, vnode, swap}\n");
+	fprintf(stderr, "\t\ttype = {malloc, vnode, swap}\n");
 	fprintf(stderr, "\t\toption = {cluster, compress, reserve}\n");
 	fprintf(stderr, "\t\tsize = %%d (512 byte blocks), %%db (B),\n");
 	fprintf(stderr, "\t\t       %%dk (kB), %%dm (MB), %%dg (GB) or\n");
@@ -148,8 +148,6 @@ main(int argc, char **argv)
 			if (!strcmp(optarg, "malloc")) {
 				mdio.md_type = MD_MALLOC;
 				mdio.md_options |= MD_AUTOUNIT | MD_COMPRESS;
-			} else if (!strcmp(optarg, "preload")) {
-				mdio.md_type = MD_PRELOAD;
 			} else if (!strcmp(optarg, "vnode")) {
 				mdio.md_type = MD_VNODE;
 				mdio.md_options |= MD_CLUSTER | MD_AUTOUNIT | MD_COMPRESS;
diff --git a/sys/dev/md/md.c b/sys/dev/md/md.c
index 443c127de755..00ef7e53974d 100644
--- a/sys/dev/md/md.c
+++ b/sys/dev/md/md.c
@@ -854,27 +854,6 @@ mdinit(struct md_s *sc)
 	    DEVSTAT_ALL_SUPPORTED, DEVSTAT_TYPE_DIRECT, DEVSTAT_PRIORITY_MAX);
 }
 
-/*
- * XXX: we should check that the range they feed us is mapped.
- * XXX: we should implement read-only.
- */
-
-static int
-mdcreate_preload(struct md_s *sc, struct md_ioctl *mdio)
-{
-
-	if (mdio->md_options & ~(MD_AUTOUNIT | MD_FORCE))
-		return (EINVAL);
-	if (mdio->md_base == 0)
-		return (EINVAL);
-	sc->flags = mdio->md_options & MD_FORCE;
-	/* Cast to pointer size, then to pointer to avoid warning */
-	sc->pl_ptr = (u_char *)(uintptr_t)mdio->md_base;
-	sc->pl_len = (size_t)sc->mediasize;
-	return (0);
-}
-
-
 static int
 mdcreate_malloc(struct md_s *sc, struct md_ioctl *mdio)
 {
@@ -1238,8 +1217,12 @@ xmdctlioctl(struct cdev *dev, u_long cmd, caddr_t addr, int flags, struct thread
 			error = mdcreate_malloc(sc, mdio);
 			break;
 		case MD_PRELOAD:
-			sc->start = mdstart_preload;
-			error = mdcreate_preload(sc, mdio);
+			/*
+			 * We disallow attaching preloaded memory disks via
+			 * ioctl. Preloaded memory disks are automatically
+			 * attached in g_md_init().
+			 */
+			error = EOPNOTSUPP;
 			break;
 		case MD_VNODE:
 			sc->start = mdstart_vnode;