d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Don't access userspace directly from the kernel in nxge(4).

Browse Source 
Update to what the previous code seemed to be doing via the correct
interfaces.  Further issues exist in xge_ioctl_registers(), but this is
debugging code in a driver that has few users and they don't appear to
be crashes or leaks.

Reviewed by:	jhb (prior version)
MFC after:	1 week
Sponsored by:	DARPA, AFRL
Differential Revision:	https://reviews.freebsd.org/D14848
This commit is contained in:
Brooks Davis 2018-03-27 21:14:39 +00:00
parent 2f471660fb
commit c8168d9b4c
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=331654
1 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
sys/dev/nxge/if_nxge.c
View File

@ -1364,11 +1364,15 @@ int
xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
{
xge_hal_status_e status = XGE_HAL_OK;
char *data = (char *)ifreqp->ifr_data;
char cmd, mode;
void *info = NULL;
int retValue = EINVAL;
switch(*data) {
cmd = fubyte(ifreqp->ifr_data);
if (cmd == -1)
return (EFAULT);
switch(cmd) {
case XGE_QUERY_STATS:
mtx_lock(&lldev->mtx_drv);
status = xge_hal_stats_hw(lldev->devh,
@ -1496,8 +1500,8 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
case XGE_SET_BUFFER_MODE_1:
case XGE_SET_BUFFER_MODE_2:
case XGE_SET_BUFFER_MODE_5:
*data = (*data == XGE_SET_BUFFER_MODE_1) ? 'Y':'N';
if(copyout(data, ifreqp->ifr_data, sizeof(data)) == 0)
mode = (cmd == XGE_SET_BUFFER_MODE_1) ? 'Y':'N';
if(copyout(&mode, ifreqp->ifr_data, sizeof(mode)) == 0)
retValue = 0;
break;
default:
@ -1518,11 +1522,18 @@ xge_ioctl_stats(xge_lldev_t *lldev, struct ifreq *ifreqp)
int
xge_ioctl_registers(xge_lldev_t *lldev, struct ifreq *ifreqp)
{
xge_register_t *data = (xge_register_t *)ifreqp->ifr_data;
xge_register_t tmpdata;
xge_register_t *data;
xge_hal_status_e status = XGE_HAL_OK;
int retValue = EINVAL, offset = 0, index = 0;
int error;
u64 val64 = 0;
error = copyin(ifreqp->ifr_data, &tmpdata, sizeof(tmpdata));
if (error != 0)
return (error);
data = &tmpdata;
/* Reading a register */
if(strcmp(data->option, "-r") == 0) {
data->value = 0x0000;