From 2602ef7cfabf0fe981066bf9b60917f8500e898a Mon Sep 17 00:00:00 2001 From: =?utf8?q?Roger=20Pau=20Monn=C3=A9?= Date: Wed, 2 May 2018 10:19:17 +0000 Subject: [PATCH] xen: fix gntdev Current interface to the gntdev in FreeBSD is wrong, and mostly worked out of luck before the PTI FreeBSD fixes, when kernel and user-space where sharing the same page tables. On FreeBSD ioctls have the size of the passed struct encoded in the ioctl number, because the generic ioctl handler in the OS takes care of copying the data from user-space to kernel space, and then calls the device specific ioctl handler. Thus using ioctl structs with variable sizes is not possible. The fix is to turn the array of structs at the end of ioctl_gntdev_alloc_gref and ioctl_gntdev_map_grant_ref into pointers, that can be properly accessed from the kernel gntdev driver using the copyin/copyout functions. Note that this is exactly how it's done for the privcmd driver. Sponsored by: Citrix Systems R&D --- sys/dev/xen/gntdev/gntdev.c | 25 ++++++++++++++++++------- sys/xen/gntdev.h | 4 ++-- 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/sys/dev/xen/gntdev/gntdev.c b/sys/dev/xen/gntdev/gntdev.c index 451a67a96e6..3bed65c4495 100644 --- a/sys/dev/xen/gntdev/gntdev.c +++ b/sys/dev/xen/gntdev/gntdev.c @@ -414,7 +414,7 @@ gntdev_alloc_gref(struct ioctl_gntdev_alloc_gref *arg) /* Copy the output values. */ arg->index = file_offset; for (i = 0; i < arg->count; i++) - arg->gref_ids[i] = grefs[i].gref_id; + suword32(&arg->gref_ids[i], grefs[i].gref_id); /* Modify the per user private data. */ mtx_lock(&priv_user->user_data_lock); @@ -659,18 +659,29 @@ gntdev_map_grant_ref(struct ioctl_gntdev_map_grant_ref *arg) gmap->grant_map_ops = malloc(sizeof(struct gnttab_map_grant_ref) * arg->count, M_GNTDEV, M_WAITOK | M_ZERO); - - error = get_file_offset(priv_user, arg->count, &gmap->file_index); - if (error != 0) - return (error); for (i = 0; i < arg->count; i++) { - gmap->grant_map_ops[i].dom = arg->refs[i].domid; - gmap->grant_map_ops[i].ref = arg->refs[i].ref; + struct ioctl_gntdev_grant_ref ref; + + error = copyin(&arg->refs[i], &ref, sizeof(ref)); + if (error != 0) { + free(gmap->grant_map_ops, M_GNTDEV); + free(gmap, M_GNTDEV); + return (error); + } + gmap->grant_map_ops[i].dom = ref.domid; + gmap->grant_map_ops[i].ref = ref.ref; gmap->grant_map_ops[i].handle = -1; gmap->grant_map_ops[i].flags = GNTMAP_host_map; } + error = get_file_offset(priv_user, arg->count, &gmap->file_index); + if (error != 0) { + free(gmap->grant_map_ops, M_GNTDEV); + free(gmap, M_GNTDEV); + return (error); + } + mtx_lock(&priv_user->user_data_lock); RB_INSERT(gmap_tree_head, &priv_user->gmap_tree, gmap); mtx_unlock(&priv_user->user_data_lock); diff --git a/sys/xen/gntdev.h b/sys/xen/gntdev.h index a364e85f778..18b3b815448 100644 --- a/sys/xen/gntdev.h +++ b/sys/xen/gntdev.h @@ -139,7 +139,7 @@ struct ioctl_gntdev_alloc_gref { /* OUT parameters */ uint64_t index; /* Variable OUT parameter */ - uint32_t gref_ids[1]; + uint32_t *gref_ids; }; #define GNTDEV_ALLOC_FLAG_WRITABLE 1 @@ -168,7 +168,7 @@ struct ioctl_gntdev_map_grant_ref { /* OUT parameters */ uint64_t index; /* Variable IN parameter */ - struct ioctl_gntdev_grant_ref refs[1]; + struct ioctl_gntdev_grant_ref *refs; }; #define IOCTL_GNTDEV_UNMAP_GRANT_REF \ -- 2.45.0