d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

xen: fix gntdev

Browse Source 
Current interface to the gntdev in FreeBSD is wrong, and mostly worked
out of luck before the PTI FreeBSD fixes, when kernel and user-space
where sharing the same page tables.

On FreeBSD ioctls have the size of the passed struct encoded in the
ioctl number, because the generic ioctl handler in the OS takes care
of copying the data from user-space to kernel space, and then calls
the device specific ioctl handler. Thus using ioctl structs with
variable sizes is not possible.

The fix is to turn the array of structs at the end of
ioctl_gntdev_alloc_gref and ioctl_gntdev_map_grant_ref into pointers,
that can be properly accessed from the kernel gntdev driver using the
copyin/copyout functions. Note that this is exactly how it's done for
the privcmd driver.

Sponsored by:   Citrix Systems R&D
This commit is contained in:
Roger Pau Monné 2018-05-02 10:19:17 +00:00
parent fc9bdb4ee5
commit 2602ef7cfa
2 changed files with 20 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
sys/dev/xen/gntdev/gntdev.c
View File

@ -414,7 +414,7 @@ gntdev_alloc_gref(struct ioctl_gntdev_alloc_gref *arg)
/* Copy the output values. */
arg->index = file_offset;
for (i = 0; i < arg->count; i++)
arg->gref_ids[i] = grefs[i].gref_id;
suword32(&arg->gref_ids[i], grefs[i].gref_id);
/* Modify the per user private data. */
mtx_lock(&priv_user->user_data_lock);
@ -659,18 +659,29 @@ gntdev_map_grant_ref(struct ioctl_gntdev_map_grant_ref *arg)
gmap->grant_map_ops =
malloc(sizeof(struct gnttab_map_grant_ref) * arg->count,
M_GNTDEV, M_WAITOK | M_ZERO);
error = get_file_offset(priv_user, arg->count, &gmap->file_index);
if (error != 0)
return (error);
for (i = 0; i < arg->count; i++) {
gmap->grant_map_ops[i].dom = arg->refs[i].domid;
gmap->grant_map_ops[i].ref = arg->refs[i].ref;
struct ioctl_gntdev_grant_ref ref;
error = copyin(&arg->refs[i], &ref, sizeof(ref));
if (error != 0) {
free(gmap->grant_map_ops, M_GNTDEV);
free(gmap, M_GNTDEV);
return (error);
}
gmap->grant_map_ops[i].dom = ref.domid;
gmap->grant_map_ops[i].ref = ref.ref;
gmap->grant_map_ops[i].handle = -1;
gmap->grant_map_ops[i].flags = GNTMAP_host_map;
}
error = get_file_offset(priv_user, arg->count, &gmap->file_index);
if (error != 0) {
free(gmap->grant_map_ops, M_GNTDEV);
free(gmap, M_GNTDEV);
return (error);
}
mtx_lock(&priv_user->user_data_lock);
RB_INSERT(gmap_tree_head, &priv_user->gmap_tree, gmap);
mtx_unlock(&priv_user->user_data_lock);

4
sys/xen/gntdev.h
View File

@ -139,7 +139,7 @@ struct ioctl_gntdev_alloc_gref {
/* OUT parameters */
uint64_t index;
/* Variable OUT parameter */
uint32_t gref_ids[1];
uint32_t *gref_ids;
};
#define GNTDEV_ALLOC_FLAG_WRITABLE 1
@ -168,7 +168,7 @@ struct ioctl_gntdev_map_grant_ref {
/* OUT parameters */
uint64_t index;
/* Variable IN parameter */
struct ioctl_gntdev_grant_ref refs[1];
struct ioctl_gntdev_grant_ref *refs;
};
#define IOCTL_GNTDEV_UNMAP_GRANT_REF \