From patchwork Sat Nov 18 23:18:44 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Flavio Cruz X-Patchwork-Id: 1865606 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=f/0NHNVf; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=sourceware.org (client-ip=2620:52:3:1:0:246e:9693:128c; helo=server2.sourceware.org; envelope-from=libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org; receiver=patchwork.ozlabs.org) Received: from server2.sourceware.org (server2.sourceware.org [IPv6:2620:52:3:1:0:246e:9693:128c]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SXqTm3nDQz1yRV for ; Sun, 19 Nov 2023 10:19:00 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 614D63858402 for ; Sat, 18 Nov 2023 23:18:57 +0000 (GMT) X-Original-To: libc-alpha@sourceware.org Delivered-To: libc-alpha@sourceware.org Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) by sourceware.org (Postfix) with ESMTPS id B73C23858D33 for ; Sat, 18 Nov 2023 23:18:47 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.2 sourceware.org B73C23858D33 Authentication-Results: sourceware.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gmail.com ARC-Filter: OpenARC Filter v1.0.0 sourceware.org B73C23858D33 Authentication-Results: server2.sourceware.org; arc=none smtp.remote-ip=2607:f8b0:4864:20::72a ARC-Seal: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1700349529; cv=none; b=BuPn9OfDNT5MedkN1gfFv6Nx0+CXjT5WtHAaZYTyz4caOjT66rsZCbhDDwLzXXChvjdd5WLIg2iryx7V/rb05FCf4j8sXFq210Z8T6sK/JyHGYui26jw8OwLQtY0t7Cduu9N5tBXUpLFhh20lZqXvofYDQ0Y6PIJF8f6KSWw4WE= ARC-Message-Signature: i=1; a=rsa-sha256; d=sourceware.org; s=key; t=1700349529; c=relaxed/simple; bh=L8sNrRRia8fzwYzY48zCgCNXTlKGh3m4C7CRETMCLks=; h=DKIM-Signature:Date:From:To:Subject:Message-ID:MIME-Version; b=Cjs6dt9JIAmqfQUpIjiXaFbG0BEa6sW9sGy5L3agDTeEUy4vC3DL2U+fY6X8jTZwGJp4dYNklWq7nxhaQ72UoTwad7Y0Uu+x9siAnIauZxDU2YklnF7jCDa8ek0pdeEOJBdr84+cnfX2+gQ/W5nkzc1cIiEmnDl1hRtOcI1SXuM= ARC-Authentication-Results: i=1; server2.sourceware.org Received: by mail-qk1-x72a.google.com with SMTP id af79cd13be357-778999c5ecfso197230785a.2 for ; Sat, 18 Nov 2023 15:18:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1700349526; x=1700954326; darn=sourceware.org; h=content-disposition:mime-version:message-id:subject:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=caEHtLUYdu9hEotquuiLcwaeqFjdjHmbjaN+dxJboMw=; b=f/0NHNVfqzbXYeE9tcb7LRmvBfIlBo2mfS3knW1a8zHqypmNIqixv1WUp4Al4V9kGI Jfw1VwvftZEpt9KEIJt3JlLi5TYsNni1i5ci+CxQYypwAlrvyCCRWPSuVbWtZ+ZKUAfk IN9UAfk2xwKDnbSbcPwl72+kLCcczafyqJINarlIrBGNFW/1mfJl1Y5bxXa4wBw8NZhl KN8bR5ECdxWeNQ8KVh1VWM4Ij6FCwlT5XFyzd59qc8yx3gI64UySWhkdkhF4xV1U0h6g 4WH9t93xZAt45kbsYf90w88rN7cYZ3+v3H2uo852EgRN2NpRhRBKe46dZFJt67Ye/QCp ufRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700349526; x=1700954326; h=content-disposition:mime-version:message-id:subject:to:from:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=caEHtLUYdu9hEotquuiLcwaeqFjdjHmbjaN+dxJboMw=; b=jonKw5jj1y8ZO1r7JNFCDuz9bkgyAFg2SJpaKZeeRlZ4fb98tGPRgQGJNk6z4HlSnU J2Ek7hL+O3miCTjgp9ejQdD81vymY4SgtZq/FZVDFVbxjU8A36xriKO/W21kagQ2OCnq z4Z/bxMfrZCaoI9FRfe3FeXCc75P205ScnDiNgJ5IF1rxPhxNAo2ePXMxhdElQ7JBk5n eiRGR50nyXtOTH/WGIvP2ckhwMeWsUO1WKOiRa2JfZ3pbQsL5rdHDbH51V4gYFuuOpmH 4CHeX1KQtHxp2fhKgC/LaNmoKryMqmEAqR67GX7GEs2ib8vg4kauJBAJGfGuKavgezYi Q6Pw== X-Gm-Message-State: AOJu0YxTjXJsEAdyStqjithIEMgnE4Agfl62uruNMYu6KxkzrhS2fgfk wlQEiTX0q9fXTWwi5GXTTvMrBISr4w== X-Google-Smtp-Source: AGHT+IFXCe6MDO1rcOzCfvHQRdwNkt91o+gzhygQNQw3Q00VMHi39X01xKjFmcL/LSOzd0uMtpmlBw== X-Received: by 2002:a05:620a:261c:b0:767:f1de:293c with SMTP id z28-20020a05620a261c00b00767f1de293cmr4137823qko.59.1700349525916; Sat, 18 Nov 2023 15:18:45 -0800 (PST) Received: from jupiter.tail36e24.ts.net (dynamic-acs-24-154-253-225.zoominternet.net. [24.154.253.225]) by smtp.gmail.com with ESMTPSA id qx11-20020a05620a8b8b00b00774830b40d4sm1604820qkn.47.2023.11.18.15.18.45 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Nov 2023 15:18:45 -0800 (PST) Date: Sat, 18 Nov 2023 18:18:44 -0500 From: Flavio Cruz To: bug-hurd@gnu.org, libc-alpha@sourceware.org Subject: [PATCH glibc] _hurd_intr_rpc_mach_msg: handle message iteration correctly. Message-ID: MIME-Version: 1.0 Content-Disposition: inline X-Spam-Status: No, score=-12.2 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, FREEMAIL_FROM, GIT_PATCH_0, RCVD_IN_DNSWL_NONE, SPF_HELO_NONE, SPF_PASS, TXREP, T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on server2.sourceware.org X-BeenThere: libc-alpha@sourceware.org X-Mailman-Version: 2.1.30 Precedence: list List-Id: Libc-alpha mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: libc-alpha-bounces+incoming=patchwork.ozlabs.org@sourceware.org The `ty` pointer is only set at the end of the loop so that `msgtl_header.msgt_inline` and `msgtl_header.msgt_deallocate` remain valid. Also, when deallocating memory, we use the length from the message directly rather than hard coding mach_port_t since we want to deallocate any kind of OOL data. --- hurd/intr-msg.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/hurd/intr-msg.c b/hurd/intr-msg.c index 98f588f2..737bfe0f 100644 --- a/hurd/intr-msg.c +++ b/hurd/intr-msg.c @@ -186,12 +186,14 @@ _hurd_intr_rpc_mach_msg (mach_msg_header_t *msg, mach_msg_type_size_t size; mach_msg_type_number_t number; - inline void clean_ports (mach_port_t *ports, int dealloc) + inline void clean_ports_and_memory (char *data, const vm_size_t length, + int dealloc) { mach_msg_type_number_t i; switch (name) { case MACH_MSG_TYPE_MOVE_SEND: + mach_port_t *ports = (mach_port_t *) data; for (i = 0; i < number; i++) __mach_port_deallocate (__mach_task_self (), *ports++); if (ty->msgtl_header.msgt_longform) @@ -207,40 +209,38 @@ _hurd_intr_rpc_mach_msg (mach_msg_header_t *msg, assert (! "unexpected port type in interruptible RPC"); } if (dealloc) - __vm_deallocate (__mach_task_self (), - (vm_address_t) ports, - number * sizeof (mach_port_t)); + __vm_deallocate (__mach_task_self (), (vm_address_t) data, length); } + char *data; if (ty->msgtl_header.msgt_longform) { name = ty->msgtl_name; size = ty->msgtl_size; number = ty->msgtl_number; - ty = (void *) ty + sizeof (mach_msg_type_long_t); + data = (char *) ty + sizeof (mach_msg_type_long_t); } else { name = ty->msgtl_header.msgt_name; size = ty->msgtl_header.msgt_size; number = ty->msgtl_header.msgt_number; - ty = (void *) ty + sizeof (mach_msg_type_t); + data = (char *) ty + sizeof (mach_msg_type_t); } + const vm_size_t length = ((number * size) + 7) >> 3; if (ty->msgtl_header.msgt_inline) { /* Calculate length of data in bytes. */ - const vm_size_t length = ((number * size) + 7) >> 3; - clean_ports ((void *) ty, 0); + clean_ports_and_memory (data, length, 0); /* Move to the next argument. */ - ty = (void *) PTR_ALIGN_UP ((char *) ty + length, - __alignof__ (uintptr_t)); + ty = (void *) PTR_ALIGN_UP (data + length, __alignof__ (uintptr_t)); } else { - clean_ports (*(void **) ty, + clean_ports_and_memory (*(void **) data, length, ty->msgtl_header.msgt_deallocate); - ty = (void *) ty + sizeof (void *); + ty = (void *) data + sizeof (void *); } } #else /* Untyped Mach IPC flavor. */