Don't use fuword() and suword() on struct members of type int. This

happens to work on 32-bit platforms as sizeof(long)=sizeof(int), but
wrecks all kinds of havoc (garbage reads, corrupting writes and
misaligned loads/stores) on 64-bit architectures.
The fix for now is to use fuword32() and suword32() and change the
type of the applicable int fields to int32. This is to make it
explicit that we depend on these fields being 32-bit. We may want
to revisit this later.

Reviewed by: deischen

1 files changed, 4 insertions, 4 deletions

diff --git a/sys/kern/kern_kse.c b/sys/kern/kern_kse.c
index 2545fe6..e02cede 100644
--- a/sys/kern/kern_kse.c
+++ b/sys/kern/kern_kse.c
@@ -1012,8 +1012,8 @@ thread_export_context(struct thread *td)
 
 	/* Exports clock ticks in kernel mode */
 	addr = (caddr_t)(&td->td_mailbox->tm_sticks);
-	temp = fuword(addr) + td->td_usticks;
-	if (suword(addr, temp)) {
+	temp = fuword32(addr) + td->td_usticks;
+	if (suword32(addr, temp)) {
 		error = EFAULT;
 		goto bad;
 	}
@@ -1167,7 +1167,7 @@ thread_update_usr_ticks(struct thread *td, int user)
 		addr = (caddr_t)&tmbx->tm_sticks;
 	}
 	if (uticks) {
-		if (suword(addr, uticks+fuword(addr))) {
+		if (suword32(addr, uticks+fuword32(addr))) {
 			PROC_LOCK(p);
 			psignal(p, SIGSEGV);
 			PROC_UNLOCK(p);
@@ -1576,7 +1576,7 @@ thread_user_enter(struct proc *p, struct thread *td)
 		KASSERT(ku, ("%s: no upcall owned", __func__));
 		KASSERT((ku->ku_owner == td), ("%s: wrong owner", __func__));
 		KASSERT(!TD_CAN_UNBIND(td), ("%s: can unbind", __func__));
-		ku->ku_mflags = fuword((void *)&ku->ku_mailbox->km_flags);
+		ku->ku_mflags = fuword32((void *)&ku->ku_mailbox->km_flags);
 		tmbx = (void *)fuword((void *)&ku->ku_mailbox->km_curthread);
 		if ((tmbx == NULL) || (tmbx == (void *)-1)) {
 			td->td_mailbox = NULL;