Changeset ae66564 in mainline

Timestamp:

2016-09-17T15:26:25Z (8 years ago)

Author:

Jakub Jermar <jakub@…>

Branches:

lfn, master, serial, ticket/834-toolchain-update, topic/msim-upgrade, topic/simplify-dev-export

Children:

5a97302

Parents:

560b81c

Message:

Add reference to frame only if the action was initiated by the kernel

Location:

kernel/generic

Files:

• include/ipc/sysipc.h (modified) (1 diff)
• src/ipc/ops/pagein.c (modified) (1 diff)
• src/ipc/sysipc.c (modified) (3 diffs)
• src/mm/backend_user.c (modified) (1 diff)

kernel/generic/include/ipc/sysipc.h

@@ -40 +40 @@
 #include <typedefs.h>
 
-extern int ipc_req_internal(int, ipc_data_t *);
+extern int ipc_req_internal(int, ipc_data_t *, sysarg_t);
 
 extern sysarg_t sys_ipc_call_async_fast(sysarg_t, sysarg_t, sysarg_t,

kernel/generic/src/ipc/ops/pagein.c

@@ -46 +46 @@
 static int answer_preprocess(call_t *answer, ipc_data_t *olddata)
 {
+        /*
+         * We only do the special handling below if the call was initiated by
+         * the kernel. Otherwise a malicious task could use this mechanism to
+         * hold memory frames forever.
+         */
+        if (!answer->priv)
+                return EOK;
+
         if (!IPC_GET_RETVAL(answer->data)) {
+
                 pte_t pte;
                 uintptr_t frame;

kernel/generic/src/ipc/sysipc.c

@@ -265 +265 @@
  * @param phoneid     Phone handle for the call.
  * @param data[inout] Structure with request/reply data.
+ * @param priv        Value to be stored in call->priv.
  *
  * @return EOK on success.
@@ -270 +271 @@
  *
  */
-int ipc_req_internal(int phoneid, ipc_data_t *data)
+int ipc_req_internal(int phoneid, ipc_data_t *data, sysarg_t priv)
 {
         phone_t *phone;
@@ -277 +278 @@
         
         call_t *call = ipc_call_alloc(0);
+        call->priv = priv;
         memcpy(call->data.args, data->args, sizeof(data->args));
         

kernel/generic/src/mm/backend_user.c

@@ -125 +125 @@
         IPC_SET_ARG5(data, pager_info->id3);
 
-        int rc = ipc_req_internal(pager_info->pager, &data);
+        int rc = ipc_req_internal(pager_info->pager, &data, (sysarg_t) true);
 
         if (rc != EOK) {