Changeset 78ffb70 in mainline for kernel/generic/src/ipc/irq.c

Timestamp:

2010-12-19T14:14:47Z (14 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

be942bc, eff1f033

Parents:

40dc422

Message:

ipc_irq_register() and ipc_irq_unregister() should check for out-of-limit INRs
passed from userspace.

File:

• kernel/generic/src/ipc/irq.c (modified) (4 diffs)

kernel/generic/src/ipc/irq.c

@@ -131 +131 @@
 /** Register an answerbox as a receiving end for IRQ notifications.
  *
- * @param box     Receiving answerbox.
- * @param inr     IRQ number.
- * @param devno   Device number.
- * @param imethod Interface and method to be associated
- *                with the notification.
- * @param ucode   Uspace pointer to top-half pseudocode.
- *
- * @return EBADMEM, ENOENT or EEXISTS on failure or 0 on success.
+ * @param box           Receiving answerbox.
+ * @param inr           IRQ number.
+ * @param devno         Device number.
+ * @param imethod       Interface and method to be associated with the
+ *                      notification.
+ * @param ucode         Uspace pointer to top-half pseudocode.
+ * @return              EOK on success or a negative error code.
  *
  */
@@ -148 +147 @@
                 (sysarg_t) devno
         };
+
+        if ((inr < 0) || (inr > last_inr))
+                return ELIMIT;
         
         irq_code_t *code;
@@ -208 +210 @@
 /** Unregister task from IRQ notification.
  *
- * @param box   Answerbox associated with the notification.
- * @param inr   IRQ number.
- * @param devno Device number.
- *
+ * @param box           Answerbox associated with the notification.
+ * @param inr           IRQ number.
+ * @param devno         Device number.
+ * @return              EOK on success or a negative error code.
  */
 int ipc_irq_unregister(answerbox_t *box, inr_t inr, devno_t devno)
@@ -219 +221 @@
                 (sysarg_t) devno
         };
+
+        if ((inr < 0) || (inr > last_inr))
+                return ELIMIT;
         
         irq_spinlock_lock(&irq_uspace_hash_table_lock, true);