LadybirdBrowser/ladybird
1
1
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-20 09:49:15 +03:00
Code Issues Packages Projects Releases Wiki Activity

Kernel: Remove SmapDisabler in sys$ioctl()

Browse Source 
Use copy_{to,from}_user() in the various File::ioctl() implementations
instead of disabling SMAP wholesale in sys$ioctl().

This patch does not port IPv4Socket::ioctl() to those API's since that
will be more involved. That function now creates a local SmapDisabler.
This commit is contained in:
Andreas Kling 2020-07-31 00:17:25 +02:00
parent be7add690d
commit 292cd53192
Notes: sideshowbarker 2024-07-19 04:27:08 +09:00 
Author: https://github.com/awesomekling
Commit: https://github.com/SerenityOS/serenity/commit/292cd53192e
5 changed files with 78 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
Kernel/Devices/BXVGADevice.cpp
View File

@ -26,11 +26,11 @@
#include <AK/Checked.h>
#include <Kernel/Devices/BXVGADevice.h>
#include <Kernel/IO.h>
#include <Kernel/PCI/Access.h>
#include <Kernel/Process.h>
#include <Kernel/VM/AnonymousVMObject.h>
#include <Kernel/VM/MemoryManager.h>
#include <Kernel/IO.h>
#include <LibC/errno_numbers.h>
#include <LibC/sys/ioctl_numbers.h>
@ -200,14 +200,16 @@ int BXVGADevice::ioctl(FileDescription&, unsigned request, FlatPtr arg)
auto* out = (size_t*)arg;
if (!Process::current()->validate_write_typed(out))
return -EFAULT;
*out = framebuffer_size_in_bytes();
size_t value = framebuffer_size_in_bytes();
copy_to_user(out, &value);
return 0;
}
case FB_IOCTL_GET_BUFFER: {
auto* index = (int*)arg;
if (!Process::current()->validate_write_typed(index))
return -EFAULT;
*index = m_y_offset == 0 ? 0 : 1;
int value = m_y_offset == 0 ? 0 : 1;
copy_to_user(index, &value);
return 0;
}
case FB_IOCTL_SET_BUFFER: {
@ -217,35 +219,42 @@ int BXVGADevice::ioctl(FileDescription&, unsigned request, FlatPtr arg)
return 0;
}
case FB_IOCTL_GET_RESOLUTION: {
auto* resolution = (FBResolution*)arg;
if (!Process::current()->validate_write_typed(resolution))
auto* user_resolution = (FBResolution*)arg;
if (!Process::current()->validate_write_typed(user_resolution))
return -EFAULT;
resolution->pitch = m_framebuffer_pitch;
resolution->width = m_framebuffer_width;
resolution->height = m_framebuffer_height;
FBResolution resolution;
resolution.pitch = m_framebuffer_pitch;
resolution.width = m_framebuffer_width;
resolution.height = m_framebuffer_height;
copy_to_user(user_resolution, &resolution);
return 0;
}
case FB_IOCTL_SET_RESOLUTION: {
auto* resolution = (FBResolution*)arg;
if (!Process::current()->validate_read_typed(resolution) || !Process::current()->validate_write_typed(resolution))
auto* user_resolution = (FBResolution*)arg;
if (!Process::current()->validate_write_typed(user_resolution))
return -EFAULT;
if (resolution->width > MAX_RESOLUTION_WIDTH || resolution->height > MAX_RESOLUTION_HEIGHT)
FBResolution resolution;
if (!Process::current()->validate_read_and_copy_typed(&resolution, user_resolution))
return -EFAULT;
if (resolution.width > MAX_RESOLUTION_WIDTH || resolution.height > MAX_RESOLUTION_HEIGHT)
return -EINVAL;
if (!set_resolution(resolution->width, resolution->height)) {
if (!set_resolution(resolution.width, resolution.height)) {
#ifdef BXVGA_DEBUG
dbg() << "Reverting Resolution: [" << m_framebuffer_width << "x" << m_framebuffer_height << "]";
#endif
resolution->pitch = m_framebuffer_pitch;
resolution->width = m_framebuffer_width;
resolution->height = m_framebuffer_height;
resolution.pitch = m_framebuffer_pitch;
resolution.width = m_framebuffer_width;
resolution.height = m_framebuffer_height;
copy_to_user(user_resolution, &resolution);
return -EINVAL;
}
#ifdef BXVGA_DEBUG
dbg() << "New resolution: [" << m_framebuffer_width << "x" << m_framebuffer_height << "]";
#endif
resolution->pitch = m_framebuffer_pitch;
resolution->width = m_framebuffer_width;
resolution->height = m_framebuffer_height;
resolution.pitch = m_framebuffer_pitch;
resolution.width = m_framebuffer_width;
resolution.height = m_framebuffer_height;
copy_to_user(user_resolution, &resolution);
return 0;
}
default:

30
Kernel/Devices/MBVGADevice.cpp
View File

@ -81,32 +81,38 @@ int MBVGADevice::ioctl(FileDescription&, unsigned request, FlatPtr arg)
auto* out = (size_t*)arg;
if (!Process::current()->validate_write_typed(out))
return -EFAULT;
*out = framebuffer_size_in_bytes();
size_t value = framebuffer_size_in_bytes();
copy_to_user(out, &value);
return 0;
}
case FB_IOCTL_GET_BUFFER: {
auto* index = (int*)arg;
if (!Process::current()->validate_write_typed(index))
return -EFAULT;
*index = 0;
int value = 0;
copy_to_user(index, &value);
return 0;
}
case FB_IOCTL_GET_RESOLUTION: {
auto* resolution = (FBResolution*)arg;
if (!Process::current()->validate_write_typed(resolution))
auto* user_resolution = (FBResolution*)arg;
if (!Process::current()->validate_write_typed(user_resolution))
return -EFAULT;
resolution->pitch = m_framebuffer_pitch;
resolution->width = m_framebuffer_width;
resolution->height = m_framebuffer_height;
FBResolution resolution;
resolution.pitch = m_framebuffer_pitch;
resolution.width = m_framebuffer_width;
resolution.height = m_framebuffer_height;
copy_to_user(user_resolution, &resolution);
return 0;
}
case FB_IOCTL_SET_RESOLUTION: {
auto* resolution = (FBResolution*)arg;
if (!Process::current()->validate_read_typed(resolution) || !Process::current()->validate_write_typed(resolution))
auto* user_resolution = (FBResolution*)arg;
if (!Process::current()->validate_read_typed(user_resolution) || !Process::current()->validate_write_typed(user_resolution))
return -EFAULT;
resolution->pitch = m_framebuffer_pitch;
resolution->width = m_framebuffer_width;
resolution->height = m_framebuffer_height;
FBResolution resolution;
resolution.pitch = m_framebuffer_pitch;
resolution.width = m_framebuffer_width;
resolution.height = m_framebuffer_height;
copy_to_user(user_resolution, &resolution);
return 0;
}
default:

2
Kernel/Net/IPv4Socket.cpp
View File

@ -466,6 +466,8 @@ int IPv4Socket::ioctl(FileDescription&, unsigned request, FlatPtr arg)
{
REQUIRE_PROMISE(inet);
SmapDisabler disabler;
auto ioctl_route = [request, arg]() {
auto* route = (rtentry*)arg;
if (!Process::current()->validate_read_typed(route))

1
Kernel/Syscalls/ioctl.cpp
View File

@ -34,7 +34,6 @@ int Process::sys$ioctl(int fd, unsigned request, FlatPtr arg)
auto description = file_description(fd);
if (!description)
return -EBADF;
SmapDisabler disabler;
return description->file().ioctl(*description, request, arg);
}

51
Kernel/TTY/TTY.cpp
View File

@ -284,8 +284,8 @@ int TTY::ioctl(FileDescription&, unsigned request, FlatPtr arg)
REQUIRE_PROMISE(tty);
auto& current_process = *Process::current();
pid_t pgid;
termios* tp;
winsize* ws;
termios* user_termios;
winsize* user_winsize;
#if 0
// FIXME: When should we block things?
@ -313,22 +313,26 @@ int TTY::ioctl(FileDescription&, unsigned request, FlatPtr arg)
}
m_pgid = pgid;
return 0;
case TCGETS:
tp = reinterpret_cast<termios*>(arg);
if (!current_process.validate_write(tp, sizeof(termios)))
case TCGETS: {
user_termios = reinterpret_cast<termios*>(arg);
if (!current_process.validate_write(user_termios, sizeof(termios)))
return -EFAULT;
*tp = m_termios;
copy_to_user(user_termios, &m_termios);
return 0;
}
case TCSETS:
case TCSETSF:
case TCSETSW:
tp = reinterpret_cast<termios*>(arg);
if (!current_process.validate_read(tp, sizeof(termios)))
case TCSETSW: {
user_termios = reinterpret_cast<termios*>(arg);
if (!current_process.validate_read(user_termios, sizeof(termios)))
return -EFAULT;
set_termios(*tp);
termios termios;
copy_from_user(&termios, user_termios);
set_termios(termios);
if (request == TCSETSF)
flush_input();
return 0;
}
case TCFLSH:
// Serenity's TTY implementation does not use an output buffer, so ignore TCOFLUSH.
if (arg == TCIFLUSH || arg == TCIOFLUSH) {
@ -338,22 +342,29 @@ int TTY::ioctl(FileDescription&, unsigned request, FlatPtr arg)
}
return 0;
case TIOCGWINSZ:
ws = reinterpret_cast<winsize*>(arg);
if (!current_process.validate_write(ws, sizeof(winsize)))
user_winsize = reinterpret_cast<winsize*>(arg);
if (!current_process.validate_write(user_winsize, sizeof(winsize)))
return -EFAULT;
ws->ws_row = m_rows;
ws->ws_col = m_columns;
winsize ws;
ws.ws_row = m_rows;
ws.ws_col = m_columns;
ws.ws_xpixel = 0;
ws.ws_ypixel = 0;
copy_to_user(user_winsize, &ws);
return 0;
case TIOCSWINSZ:
ws = reinterpret_cast<winsize*>(arg);
if (!current_process.validate_read(ws, sizeof(winsize)))
case TIOCSWINSZ: {
user_winsize = reinterpret_cast<winsize*>(arg);
if (!current_process.validate_read(user_winsize, sizeof(winsize)))
return -EFAULT;
if (ws->ws_col == m_columns && ws->ws_row == m_rows)
winsize ws;
copy_from_user(&ws, user_winsize);
if (ws.ws_col == m_columns && ws.ws_row == m_rows)
return 0;
m_rows = ws->ws_row;
m_columns = ws->ws_col;
m_rows = ws.ws_row;
m_columns = ws.ws_col;
generate_signal(SIGWINCH);
return 0;
}
case TIOCSCTTY:
current_process.set_tty(this);
return 0;