ilo-pona/xv6-65oo2
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Activity

fix major validation

Browse source 
fileread/filewrite should validate major to avoid buffer overflows
or bogus function pointers.
This commit is contained in:
Xi Wang 2019-09-19 10:31:04 -07:00 committed by Frans Kaashoek
parent 37df68e5de
commit 9ead904afe
1 changed files with 4 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
kernel/file.c
View file

@ -114,6 +114,8 @@ fileread(struct file *f, uint64 addr, int n)
if(f->type == FD_PIPE){ if(f->type == FD_PIPE){
r = piperead(f->pipe, addr, n); r = piperead(f->pipe, addr, n);
} else if(f->type == FD_DEVICE){ } else if(f->type == FD_DEVICE){
if(f->major < 0 || f->major >= NDEV || !devsw[f->major].read)
return -1;
r = devsw[f->major].read(1, addr, n); r = devsw[f->major].read(1, addr, n);
} else if(f->type == FD_INODE){ } else if(f->type == FD_INODE){
ilock(f->ip); ilock(f->ip);
@ -140,6 +142,8 @@ filewrite(struct file *f, uint64 addr, int n)
if(f->type == FD_PIPE){ if(f->type == FD_PIPE){
ret = pipewrite(f->pipe, addr, n); ret = pipewrite(f->pipe, addr, n);
} else if(f->type == FD_DEVICE){ } else if(f->type == FD_DEVICE){
if(f->major < 0 || f->major >= NDEV || !devsw[f->major].write)
return -1;
ret = devsw[f->major].write(1, addr, n); ret = devsw[f->major].write(1, addr, n);
} else if(f->type == FD_INODE){ } else if(f->type == FD_INODE){
// write a few blocks at a time to avoid exceeding // write a few blocks at a time to avoid exceeding