51983144e3
exec took 32 arguments and 64 environment variables, in fixed arrays, so a glob over more than 31 files failed with E2BIG. It now reads the caller's argv and envp where they are, through the uaccess helpers and a bounce page -- a second thread rewriting the array after a check cannot slip a kernel address in -- and sizes the new stack to fit them. The limits are Linux's: ARG_MAX, 2 MB of strings and pointers, and 128 KB for any one string (USER_STR_MAX follows it). Every mmap took one of a process's 256 VMA slots, and zsh takes one per 16 KB heap block, so `x=($(<file))` over 30000 words ran out after 4 MB of heap and exited 1 without a word. Neighbouring anonymous mappings now share a record, as Linux merges them -- the bump allocator puts each new one where the last ended -- and munmap trims or splits it. Partial unmaps of device or segment mappings are refused with EINVAL instead of kfree()ing pages that are not the process's, and a failed allocation half way through a mapping no longer leaks what it had. Checked under QEMU: touch over 3000 names, /bin/echo with 50000 arguments, E2BIG past 2 MB, zsh splitting 100000 words, fork loops. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01S1giNvrHTrPMPw7V6x1kQ4
49 lines
2.1 KiB
C
49 lines
2.1 KiB
C
// User-memory access API, modeled on Linux's <linux/uaccess.h>.
|
|
//
|
|
// Rules for kernel code touching user pointers:
|
|
//
|
|
// 1. Never dereference a user-supplied address without validating it
|
|
// first. A syscall argument can point anywhere, including at kernel
|
|
// memory or at nothing at all.
|
|
//
|
|
// 2. Never assume a user buffer is physically contiguous. uva2ka() only
|
|
// translates ONE page; the direct-map alias it returns runs into an
|
|
// unrelated physical page at the next 4K boundary. Any multi-byte
|
|
// access through it must stay within a single page.
|
|
//
|
|
// These helpers encapsulate both rules. Because SchOS (like old x86
|
|
// without SMAP) keeps the user page table active in kernel mode, a raw
|
|
// user virtual address is directly dereferenceable once the whole range
|
|
// has been validated — that is what user_ptr() hands back, and why the
|
|
// result is safe across page boundaries where a uva2ka() pointer is not.
|
|
#ifndef SCHOS_UACCESS_H
|
|
#define SCHOS_UACCESS_H
|
|
|
|
#include "types.h"
|
|
|
|
// Nonzero if [uaddr, uaddr+size) is entirely mapped, user-accessible
|
|
// memory in the current process. size == 0 is always ok.
|
|
int access_ok(addr_t uaddr, uint64 size);
|
|
|
|
// Validate the whole range and return it as a directly usable pointer
|
|
// (the raw user VA). 0 on bad/NULL address.
|
|
void *user_ptr(addr_t uaddr, uint64 size);
|
|
|
|
// Copy between kernel and user memory, page by page.
|
|
// Return 0 on success, -EFAULT on any unmapped page.
|
|
int copy_from_user(void *dst, addr_t uaddr, uint64 n);
|
|
int copy_to_user(addr_t uaddr, const void *src, uint64 n);
|
|
|
|
// Fixed-size scalar variants, in the spirit of Linux's get_user/put_user.
|
|
#define get_user(x, uaddr) copy_from_user(&(x), (addr_t)(uaddr), sizeof(x))
|
|
#define put_user(x, uaddr) copy_to_user((addr_t)(uaddr), &(x), sizeof(x))
|
|
|
|
// Longest string fetchstr()/strlen_user() will scan before giving up.
|
|
#define USER_STR_MAX (128 * 1024) // = ARG_STRLEN_MAX: an argument is one
|
|
|
|
// Length of the NUL-terminated string at uaddr (excluding the NUL),
|
|
// validating every page it spans. -EFAULT if it runs off mapped memory
|
|
// or exceeds USER_STR_MAX.
|
|
long strlen_user(addr_t uaddr);
|
|
|
|
#endif // SCHOS_UACCESS_H
|