Changeset 0f5c4e4 in mainline

Timestamp:

2025-05-28T19:02:32Z (35 hours ago)

Author:

Jiri Svoboda <jiri@…>

Branches:

master

Parents:

61f28c4

Message:

Fix crash in AHCI driver and sata_bd server.

Location:

uspace

Files:

• drv/block/ahci/ahci.c (modified) (2 diffs)
• lib/drv/generic/remote_ahci.c (modified) (5 diffs)

uspace/drv/block/ahci/ahci.c

@@ -1 +1 @@
 /*
+ * Copyright (c) 2025 Jiri Svoboda
  * Copyright (c) 2012 Petr Jerman
  * All rights reserved.
@@ -1075 +1076 @@
         }
 
+        fun = sata->fun;
         ddf_fun_set_ops(fun, &ahci_ops);
 

uspace/lib/drv/generic/remote_ahci.c

@@ -1 +1 @@
 /*
+ * Copyright (c) 2025 Jiri Svoboda
  * Copyright (c) 2012 Petr Jerman
  * All rights reserved.
@@ -152 +153 @@
             IPC_M_AHCI_READ_BLOCKS, HI(blocknum),  LO(blocknum), count, NULL);
 
-        async_share_out_start(exch, buf, AS_AREA_READ | AS_AREA_WRITE);
-
+        errno_t rc = async_data_read_start(exch, buf, count * 512);
         async_exchange_end(exch);
-
-        errno_t rc;
-        async_wait_for(req, &rc);
-
-        return rc;
+        if (rc != EOK) {
+                async_forget(req);
+                return rc;
+        }
+
+        errno_t retval;
+        async_wait_for(req, &retval);
+        return retval;
 }
 
@@ -172 +175 @@
             IPC_M_AHCI_WRITE_BLOCKS, HI(blocknum),  LO(blocknum), count, NULL);
 
-        async_share_out_start(exch, buf, AS_AREA_READ | AS_AREA_WRITE);
-
+        errno_t rc = async_data_write_start(exch, buf, count * 512);
         async_exchange_end(exch);
 
-        errno_t rc;
-        async_wait_for(req, &rc);
-
-        return rc;
+        if (rc != EOK) {
+                async_forget(req);
+                return rc;
+        }
+
+        errno_t retval;
+        async_wait_for(req, &retval);
+        return retval;
 }
 
@@ -284 +290 @@
         }
 
-        ipc_call_t data;
-        size_t maxblock_size;
-        unsigned int flags;
-        async_share_out_receive(&data, &maxblock_size, &flags);
-
-        void *buf;
-        async_share_out_finalize(&data, &buf);
-
-        const uint64_t blocknum =
+        ipc_call_t rcall;
+        size_t size;
+        if (!async_data_read_receive(&rcall, &size)) {
+                async_answer_0(&rcall, EINVAL);
+                async_answer_0(call, EINVAL);
+                return;
+        }
+
+        void *buf = malloc(size);
+        if (buf == NULL) {
+                async_answer_0(&rcall, ENOMEM);
+                async_answer_0(call, ENOMEM);
+                return;
+        }
+
+        uint64_t blocknum =
             (((uint64_t) (DEV_IPC_GET_ARG1(*call))) << 32) |
             (((uint64_t) (DEV_IPC_GET_ARG2(*call))) & 0xffffffff);
-        const size_t cnt = (size_t) DEV_IPC_GET_ARG3(*call);
-
-        const errno_t ret = ahci_iface->read_blocks(fun, blocknum, cnt, buf);
-
-        async_answer_0(call, ret);
+        size_t cnt = (size_t) DEV_IPC_GET_ARG3(*call);
+
+        errno_t rc = ahci_iface->read_blocks(fun, blocknum, cnt, buf);
+        if (rc != EOK) {
+                async_answer_0(&rcall, ENOMEM);
+                async_answer_0(call, ENOMEM);
+                free(buf);
+                return;
+        }
+
+        async_data_read_finalize(&rcall, buf, size);
+
+        free(buf);
+        async_answer_0(call, EOK);
 }
 
@@ -306 +328 @@
         const ahci_iface_t *ahci_iface = (ahci_iface_t *) iface;
 
-        if (ahci_iface->read_blocks == NULL) {
-                async_answer_0(call, ENOTSUP);
-                return;
-        }
-
-        ipc_call_t data;
-        size_t maxblock_size;
-        unsigned int flags;
-        async_share_out_receive(&data, &maxblock_size, &flags);
-
-        void *buf;
-        async_share_out_finalize(&data, &buf);
-
-        const uint64_t blocknum =
+        if (ahci_iface->write_blocks == NULL) {
+                async_answer_0(call, ENOTSUP);
+                return;
+        }
+
+        void *data;
+        size_t dsize;
+        errno_t rc = async_data_write_accept(&data, false, 0, 0, 0, &dsize);
+        if (rc != EOK) {
+                async_answer_0(call, rc);
+                return;
+        }
+
+        uint64_t blocknum =
             (((uint64_t)(DEV_IPC_GET_ARG1(*call))) << 32) |
             (((uint64_t)(DEV_IPC_GET_ARG2(*call))) & 0xffffffff);
-        const size_t cnt = (size_t) DEV_IPC_GET_ARG3(*call);
-
-        const errno_t ret = ahci_iface->write_blocks(fun, blocknum, cnt, buf);
-
-        async_answer_0(call, ret);
+        size_t cnt = (size_t) DEV_IPC_GET_ARG3(*call);
+
+        if (dsize != cnt * 512) {
+                async_answer_0(call, EINVAL);
+                return;
+        }
+
+        rc = ahci_iface->write_blocks(fun, blocknum, cnt, data);
+        free(data);
+        async_answer_0(call, rc);
 }