From abb59d7351c7ddb50c63c40430a82d94fa61917a Mon Sep 17 00:00:00 2001 From: Augustin Cavalier Date: Sun, 24 Jun 2018 23:33:32 -0400 Subject: [PATCH] intel_extreme: Fix instances of user memory creation and access. You still cannot boot to desktop under SMAP on intel_extreme, however, as the agp_gart bus has not been patched properly. Doing so breaks the intel_extreme accelerant, so more investigation is needed. --- .../drivers/graphics/intel_extreme/device.cpp | 15 ++++++++++----- .../graphics/intel_extreme/intel_extreme.cpp | 8 ++++---- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/src/add-ons/kernel/drivers/graphics/intel_extreme/device.cpp b/src/add-ons/kernel/drivers/graphics/intel_extreme/device.cpp index fa60cff07e..6a6fd701a0 100644 --- a/src/add-ons/kernel/drivers/graphics/intel_extreme/device.cpp +++ b/src/add-ons/kernel/drivers/graphics/intel_extreme/device.cpp @@ -186,18 +186,23 @@ device_ioctl(void* data, uint32 op, void* buffer, size_t bufferLength) switch (op) { case B_GET_ACCELERANT_SIGNATURE: - strcpy((char*)buffer, INTEL_ACCELERANT_NAME); TRACE("accelerant: %s\n", INTEL_ACCELERANT_NAME); + if (user_strlcpy((char*)buffer, INTEL_ACCELERANT_NAME, + B_FILE_NAME_LENGTH) < B_OK) + return B_BAD_ADDRESS; return B_OK; // needed to share data between kernel and accelerant case INTEL_GET_PRIVATE_DATA: { - intel_get_private_data* data = (intel_get_private_data* )buffer; + intel_get_private_data data; + if (user_memcpy(&data, buffer, sizeof(intel_get_private_data)) < B_OK) + return B_BAD_ADDRESS; - if (data->magic == INTEL_PRIVATE_DATA_MAGIC) { - data->shared_info_area = info->shared_area; - return B_OK; + if (data.magic == INTEL_PRIVATE_DATA_MAGIC) { + data.shared_info_area = info->shared_area; + return user_memcpy(buffer, &data, + sizeof(intel_get_private_data)); } break; } diff --git a/src/add-ons/kernel/drivers/graphics/intel_extreme/intel_extreme.cpp b/src/add-ons/kernel/drivers/graphics/intel_extreme/intel_extreme.cpp index 3ff213d82e..cb4159a8dc 100644 --- a/src/add-ons/kernel/drivers/graphics/intel_extreme/intel_extreme.cpp +++ b/src/add-ons/kernel/drivers/graphics/intel_extreme/intel_extreme.cpp @@ -212,8 +212,8 @@ init_interrupt_handler(intel_info &info) // Find the right interrupt vector, using MSIs if available. info.irq = 0xff; - info.use_msi = false; - if (info.pci->u.h0.interrupt_pin != 0x00) + info.use_msi = false; + if (info.pci->u.h0.interrupt_pin != 0x00) info.irq = info.pci->u.h0.interrupt_line; if (gPCIx86Module != NULL && gPCIx86Module->get_msi_count(info.pci->bus, info.pci->device, info.pci->function) >= 1) { @@ -316,7 +316,7 @@ intel_extreme_init(intel_info &info) info.shared_area = sharedCreator.Create("intel extreme shared info", (void**)&info.shared_info, B_ANY_KERNEL_ADDRESS, ROUND_TO_PAGE_SIZE(sizeof(intel_shared_info)) + 3 * B_PAGE_SIZE, - B_FULL_LOCK, 0); + B_FULL_LOCK, B_KERNEL_READ_AREA | B_KERNEL_WRITE_AREA | B_USER_CLONEABLE_AREA); if (info.shared_area < B_OK) { ERROR("error: could not create shared area!\n"); gGART->unmap_aperture(info.aperture); @@ -484,7 +484,7 @@ intel_extreme_init(intel_info &info) status_t status = intel_allocate_memory(info, B_PAGE_SIZE, 0, intel_uses_physical_overlay(*info.shared_info) ? B_APERTURE_NEED_PHYSICAL : 0, - (addr_t*)&info.overlay_registers, + (addr_t*)&info.overlay_registers, &info.shared_info->physical_overlay_registers); if (status == B_OK) { info.shared_info->overlay_offset = (addr_t)info.overlay_registers