diff options
author | marcel <marcel@FreeBSD.org> | 2003-06-28 19:45:15 +0000 |
---|---|---|
committer | marcel <marcel@FreeBSD.org> | 2003-06-28 19:45:15 +0000 |
commit | abc3ed480d1ab26837d03ab2d84967f33cc7d421 (patch) | |
tree | 48278e3806fb8ad64cdf7a23ab1dea7517c1baf6 /sys | |
parent | ea0a6b417ac906ddafc1c9e26c790ec44c7eafea (diff) | |
download | FreeBSD-src-abc3ed480d1ab26837d03ab2d84967f33cc7d421.zip FreeBSD-src-abc3ed480d1ab26837d03ab2d84967f33cc7d421.tar.gz |
Don't use fuword() and suword() on struct members of type int. This
happens to work on 32-bit platforms as sizeof(long)=sizeof(int), but
wrecks all kinds of havoc (garbage reads, corrupting writes and
misaligned loads/stores) on 64-bit architectures.
The fix for now is to use fuword32() and suword32() and change the
type of the applicable int fields to int32. This is to make it
explicit that we depend on these fields being 32-bit. We may want
to revisit this later.
Reviewed by: deischen
Diffstat (limited to 'sys')
-rw-r--r-- | sys/kern/kern_kse.c | 8 | ||||
-rw-r--r-- | sys/kern/kern_thread.c | 8 | ||||
-rw-r--r-- | sys/sys/kse.h | 6 |
3 files changed, 11 insertions, 11 deletions
diff --git a/sys/kern/kern_kse.c b/sys/kern/kern_kse.c index 2545fe6..e02cede 100644 --- a/sys/kern/kern_kse.c +++ b/sys/kern/kern_kse.c @@ -1012,8 +1012,8 @@ thread_export_context(struct thread *td) /* Exports clock ticks in kernel mode */ addr = (caddr_t)(&td->td_mailbox->tm_sticks); - temp = fuword(addr) + td->td_usticks; - if (suword(addr, temp)) { + temp = fuword32(addr) + td->td_usticks; + if (suword32(addr, temp)) { error = EFAULT; goto bad; } @@ -1167,7 +1167,7 @@ thread_update_usr_ticks(struct thread *td, int user) addr = (caddr_t)&tmbx->tm_sticks; } if (uticks) { - if (suword(addr, uticks+fuword(addr))) { + if (suword32(addr, uticks+fuword32(addr))) { PROC_LOCK(p); psignal(p, SIGSEGV); PROC_UNLOCK(p); @@ -1576,7 +1576,7 @@ thread_user_enter(struct proc *p, struct thread *td) KASSERT(ku, ("%s: no upcall owned", __func__)); KASSERT((ku->ku_owner == td), ("%s: wrong owner", __func__)); KASSERT(!TD_CAN_UNBIND(td), ("%s: can unbind", __func__)); - ku->ku_mflags = fuword((void *)&ku->ku_mailbox->km_flags); + ku->ku_mflags = fuword32((void *)&ku->ku_mailbox->km_flags); tmbx = (void *)fuword((void *)&ku->ku_mailbox->km_curthread); if ((tmbx == NULL) || (tmbx == (void *)-1)) { td->td_mailbox = NULL; diff --git a/sys/kern/kern_thread.c b/sys/kern/kern_thread.c index 2545fe6..e02cede 100644 --- a/sys/kern/kern_thread.c +++ b/sys/kern/kern_thread.c @@ -1012,8 +1012,8 @@ thread_export_context(struct thread *td) /* Exports clock ticks in kernel mode */ addr = (caddr_t)(&td->td_mailbox->tm_sticks); - temp = fuword(addr) + td->td_usticks; - if (suword(addr, temp)) { + temp = fuword32(addr) + td->td_usticks; + if (suword32(addr, temp)) { error = EFAULT; goto bad; } @@ -1167,7 +1167,7 @@ thread_update_usr_ticks(struct thread *td, int user) addr = (caddr_t)&tmbx->tm_sticks; } if (uticks) { - if (suword(addr, uticks+fuword(addr))) { + if (suword32(addr, uticks+fuword32(addr))) { PROC_LOCK(p); psignal(p, SIGSEGV); PROC_UNLOCK(p); @@ -1576,7 +1576,7 @@ thread_user_enter(struct proc *p, struct thread *td) KASSERT(ku, ("%s: no upcall owned", __func__)); KASSERT((ku->ku_owner == td), ("%s: wrong owner", __func__)); KASSERT(!TD_CAN_UNBIND(td), ("%s: can unbind", __func__)); - ku->ku_mflags = fuword((void *)&ku->ku_mailbox->km_flags); + ku->ku_mflags = fuword32((void *)&ku->ku_mailbox->km_flags); tmbx = (void *)fuword((void *)&ku->ku_mailbox->km_curthread); if ((tmbx == NULL) || (tmbx == (void *)-1)) { td->td_mailbox = NULL; diff --git a/sys/sys/kse.h b/sys/sys/kse.h index c2a90ab..9a5e821 100644 --- a/sys/sys/kse.h +++ b/sys/sys/kse.h @@ -58,8 +58,8 @@ struct kse_thr_mailbox { unsigned int tm_flags; /* Thread flags */ struct kse_thr_mailbox *tm_next; /* Next thread in list */ void *tm_udata; /* For use by the UTS */ - unsigned int tm_uticks; - unsigned int tm_sticks; + uint32_t tm_uticks; + uint32_t tm_sticks; siginfo_t tm_syncsig; int tm_spare[8]; }; @@ -75,7 +75,7 @@ struct kse_mailbox { struct kse_thr_mailbox *km_curthread; /* Currently running thread */ struct kse_thr_mailbox *km_completed; /* Threads back from kernel */ sigset_t km_sigscaught; /* Caught signals */ - unsigned int km_flags; /* KSE flags */ + uint32_t km_flags; /* KSE flags */ kse_func_t *km_func; /* UTS function */ stack_t km_stack; /* UTS context */ void *km_udata; /* For use by the UTS */ |