From 65496b3a280b52883b40920ce638e13979b71aac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Duval?= Date: Thu, 21 May 2020 11:09:53 +0200 Subject: [PATCH] matrox: SMAP fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit tested with success at least on VGA, see #16069. Thanks TmTFx and rudolfc! Change-Id: I4183416b09216b111984658eb8b23c8f62a0e36d Reviewed-on: https://review.haiku-os.org/c/haiku/+/2762 Reviewed-by: Jérôme Duval Tested-by: Commit checker robot --- .../kernel/drivers/graphics/matrox/driver.c | 57 ++++++++++++------- 1 file changed, 35 insertions(+), 22 deletions(-) diff --git a/src/add-ons/kernel/drivers/graphics/matrox/driver.c b/src/add-ons/kernel/drivers/graphics/matrox/driver.c index ca513edac0..8d7a07874f 100644 --- a/src/add-ons/kernel/drivers/graphics/matrox/driver.c +++ b/src/add-ons/kernel/drivers/graphics/matrox/driver.c @@ -381,7 +381,7 @@ static status_t map_device(device_info *di) di->pcii.u.h0.base_registers[frame_buffer], 32768, B_ANY_KERNEL_ADDRESS, - B_READ_AREA, + B_KERNEL_READ_AREA, (void **)&(rom_temp) ); @@ -602,7 +602,7 @@ static void copy_rom(device_info *di) di->pcii.u.h0.base_registers[frame_buffer], 32768, B_ANY_KERNEL_ADDRESS, - B_READ_AREA, + B_KERNEL_READ_AREA, (void **)&(rom_temp) ); @@ -769,7 +769,7 @@ static status_t open_hook (const char* name, uint32 flags, void** cookie) { /* create this area with NO user-space read or write permissions, to prevent accidental dammage */ di->shared_area = create_area(shared_name, (void **)&(di->si), B_ANY_KERNEL_ADDRESS, ((sizeof(shared_info) + (B_PAGE_SIZE - 1)) & ~(B_PAGE_SIZE - 1)), B_FULL_LOCK, - B_CLONEABLE_AREA); + B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA | B_CLONEABLE_AREA); if (di->shared_area < 0) { /* return the error */ result = di->shared_area; @@ -952,47 +952,60 @@ control_hook (void* dev, uint32 msg, void *buf, size_t len) { switch (msg) { /* the only PUBLIC ioctl */ case B_GET_ACCELERANT_SIGNATURE: { - char *sig = (char *)buf; - strcpy(sig, current_settings.accelerant); + if (user_strlcpy((char*)buf, current_settings.accelerant, + B_FILE_NAME_LENGTH) < B_OK) { + return B_BAD_ADDRESS; + } result = B_OK; } break; /* PRIVATE ioctl from here on */ case GX00_GET_PRIVATE_DATA: { - gx00_get_private_data *gpd = (gx00_get_private_data *)buf; - if (gpd->magic == GX00_PRIVATE_DATA_MAGIC) { - gpd->shared_info_area = di->shared_area; - result = B_OK; + gx00_get_private_data gpd; + if (user_memcpy(&gpd, buf, sizeof(gx00_get_private_data)) < B_OK) + return B_BAD_ADDRESS; + if (gpd.magic == GX00_PRIVATE_DATA_MAGIC) { + gpd.shared_info_area = di->shared_area; + result = user_memcpy(buf, &gpd, sizeof(gx00_get_private_data)); } } break; case GX00_GET_PCI: { - gx00_get_set_pci *gsp = (gx00_get_set_pci *)buf; - if (gsp->magic == GX00_PRIVATE_DATA_MAGIC) { + gx00_get_set_pci gsp; + if (user_memcpy(&gsp, buf, sizeof(gx00_get_set_pci)) < B_OK) + return B_BAD_ADDRESS; + if (gsp.magic == GX00_PRIVATE_DATA_MAGIC) { pci_info *pcii = &(di->pcii); - gsp->value = get_pci(gsp->offset, gsp->size); - result = B_OK; + gsp.value = get_pci(gsp.offset, gsp.size); + result = user_memcpy(buf, &gsp, sizeof(gx00_get_set_pci)); } } break; case GX00_SET_PCI: { - gx00_get_set_pci *gsp = (gx00_get_set_pci *)buf; - if (gsp->magic == GX00_PRIVATE_DATA_MAGIC) { + gx00_get_set_pci gsp; + if (user_memcpy(&gsp, buf, sizeof(gx00_get_set_pci)) < B_OK) + return B_BAD_ADDRESS; + if (gsp.magic == GX00_PRIVATE_DATA_MAGIC) { pci_info *pcii = &(di->pcii); - set_pci(gsp->offset, gsp->size, gsp->value); + set_pci(gsp.offset, gsp.size, gsp.value); result = B_OK; } } break; case GX00_DEVICE_NAME: { // apsed - gx00_device_name *dn = (gx00_device_name *)buf; - if (dn->magic == GX00_PRIVATE_DATA_MAGIC) { - strcpy(dn->name, di->name); + gx00_device_name dn; + if (user_memcpy(&dn, buf, sizeof(gx00_device_name)) < B_OK) + return B_BAD_ADDRESS; + if (dn.magic == GX00_PRIVATE_DATA_MAGIC) { + if (user_strlcpy(dn.name, di->name, B_OS_NAME_LENGTH) < B_OK) + return B_BAD_ADDRESS; result = B_OK; } } break; case GX00_RUN_INTERRUPTS: { - gx00_set_bool_state *ri = (gx00_set_bool_state *)buf; - if (ri->magic == GX00_PRIVATE_DATA_MAGIC) { + gx00_set_bool_state ri; + if (user_memcpy(&ri, buf, sizeof(gx00_set_bool_state)) < B_OK) + return B_BAD_ADDRESS; + if (ri.magic == GX00_PRIVATE_DATA_MAGIC) { vuint32 *regs = di->regs; - if (ri->do_it) { + if (ri.do_it) { enable_vbi(regs); } else { disable_vbi(regs);