OrgZephyr/zephyr
OrgZephyr
/
zephyr
mirror of https://github.com/zephyrproject-rtos/zephyr.git
1
0
Fork 0
Code Issues Releases Wiki Activity
zephyr/drivers/adc/adc_handlers.c

70 lines
1.6 KiB
C
Raw Normal View History

drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
/*
* Copyright (c) 2017 Intel Corporation
*
* SPDX-License-Identifier: Apache-2.0
*/
#include <adc.h>
#include <syscall_handler.h>
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
#include <string.h>
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_SYSCALL_HANDLER(adc_enable, dev)
drivers: Perform a runtime check if a driver is capable of an operation Driver APIs might not implement all operations, making it possible for a user thread to get the kernel to execute a function at 0x00000000. Perform runtime checks in all the driver handlers, checking if they're capable of performing the requested operation. Fixes #6907. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-04-05 04:50:32 +08:00
{
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_OOPS(Z_SYSCALL_DRIVER_ADC(dev, enable));
drivers: Perform a runtime check if a driver is capable of an operation Driver APIs might not implement all operations, making it possible for a user thread to get the kernel to execute a function at 0x00000000. Perform runtime checks in all the driver handlers, checking if they're capable of performing the requested operation. Fixes #6907. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-04-05 04:50:32 +08:00
_impl_adc_enable((struct device *)dev);
return 0;
}
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_SYSCALL_HANDLER(adc_disable, dev)
drivers: Perform a runtime check if a driver is capable of an operation Driver APIs might not implement all operations, making it possible for a user thread to get the kernel to execute a function at 0x00000000. Perform runtime checks in all the driver handlers, checking if they're capable of performing the requested operation. Fixes #6907. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-04-05 04:50:32 +08:00
{
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_OOPS(Z_SYSCALL_DRIVER_ADC(dev, disable));
drivers: Perform a runtime check if a driver is capable of an operation Driver APIs might not implement all operations, making it possible for a user thread to get the kernel to execute a function at 0x00000000. Perform runtime checks in all the driver handlers, checking if they're capable of performing the requested operation. Fixes #6907. Signed-off-by: Leandro Pereira <leandro.pereira@intel.com>
2018-04-05 04:50:32 +08:00
_impl_adc_disable((struct device *)dev);
return 0;
}
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_SYSCALL_HANDLER(adc_read, dev, seq_table_p)
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
{
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
struct adc_seq_entry *entry, *entries_copy;
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
struct adc_seq_table *seq_table = (struct adc_seq_table *)seq_table_p;
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
struct adc_seq_table seq_table_copy;
unsigned int entries_bounds;
int i = 0, ret;
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
syscalls: remove policy from handler checks The various macros to do checks in system call handlers all implictly would generate a kernel oops if a check failed. This is undesirable for a few reasons: * System call handlers that acquire resources in the handler have no good recourse for cleanup if a check fails. * In some cases we may want to propagate a return value back to the caller instead of just killing the calling thread, even though the base API doesn't do these checks. These macros now all return a value, if nonzero is returned the check failed. K_OOPS() now wraps these calls to generate a kernel oops. At the moment, the policy for all APIs has not changed. They still all oops upon a failed check/ The macros now use the Z_ notation for private APIs. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-05 06:57:57 +08:00
Z_OOPS(Z_SYSCALL_DRIVER_ADC(dev, read));
Z_OOPS(Z_SYSCALL_MEMORY_READ(seq_table, sizeof(struct adc_seq_table)));
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
seq_table_copy = *seq_table;
if (Z_SYSCALL_VERIFY_MSG(
!__builtin_umul_overflow(seq_table_copy.num_entries,
sizeof(struct adc_seq_entry),
&entries_bounds),
"num_entries too large")) {
ret = -EINVAL;
goto out;
}
Z_OOPS(Z_SYSCALL_MEMORY_READ(seq_table_copy.entries, entries_bounds));
entries_copy = z_thread_malloc(entries_bounds);
if (!entries_copy) {
ret = -ENOMEM;
goto out;
}
memcpy(entries_copy, seq_table_copy.entries, entries_bounds);
seq_table_copy.entries = entries_copy;
for (entry = seq_table_copy.entries; i < seq_table_copy.num_entries;
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
i++, entry++) {
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
if (Z_SYSCALL_MEMORY_WRITE(entry->buffer,
entry->buffer_length)) {
k_free(entries_copy);
Z_OOPS(1);
}
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
}
drivers: adc: fix TOCTOU attacks The toplevel adc_seq_table is now copied onto the stack and the stack copy used. The contained entries array is now copied onto an allocation drawn from the caller's resource pool, to prevent modification of the buffer pointers. The return value policy here is to oops the caller if bad memory or objects are passed in, but return an error otherwise. Based on an original patch by Leandro Pereira, rebased and the copy of the entries array added. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2018-05-18 04:38:16 +08:00
ret = _impl_adc_read((struct device *)dev, &seq_table_copy);
k_free(entries_copy);
out:
return ret;
drivers: adc: add system call handlers Straightforward conversion for adc_enable/disable. adc_read() uses a sequence table, which points to an array of struct adc_seq_entry, each element pointing to memory buffers. Need to validate all of these as being readable by the caller, and the buffers writable. Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
2017-10-26 01:48:07 +08:00
}