diff options
| author | Brooks Davis <brooks@FreeBSD.org> | 2020-10-21 16:00:15 +0000 |
|---|---|---|
| committer | Brooks Davis <brooks@FreeBSD.org> | 2020-10-21 16:00:15 +0000 |
| commit | 44ca4575ea0602c037be51beb89e1a1ad34ee649 (patch) | |
| tree | 3512d6f4207869377c7e84188834dfa79e806d10 /sys/cam/cam_periph.c | |
| parent | 7ec2f6bce5d28e6662c29e63f6ab6b7ef57d98b2 (diff) | |
| download | src-44ca4575ea0602c037be51beb89e1a1ad34ee649.tar.gz src-44ca4575ea0602c037be51beb89e1a1ad34ee649.zip | |
vmapbuf: don't smuggle address or length in buf
Instead, add arguments to vmapbuf. Since this argument is
always a pointer use a type of void * and cast to vm_offset_t in
vmapbuf. (In CheriBSD we've altered vm_fault_quick_hold_pages to
take a pointer and check its bounds.)
In no other situtation does b_data contain a user pointer and vmapbuf
replaces b_data with the actual mapping.
Suggested by: jhb
Reviewed by: imp, jhb
Obtained from: CheriBSD
MFC after: 1 week
Sponsored by: DARPA
Differential Revision: https://reviews.freebsd.org/D26784
Notes
Notes:
svn path=/head/; revision=366911
Diffstat (limited to 'sys/cam/cam_periph.c')
| -rw-r--r-- | sys/cam/cam_periph.c | 8 |
1 files changed, 1 insertions, 7 deletions
diff --git a/sys/cam/cam_periph.c b/sys/cam/cam_periph.c index 96a83261b199..cc4a6d41ae76 100644 --- a/sys/cam/cam_periph.c +++ b/sys/cam/cam_periph.c @@ -955,18 +955,12 @@ cam_periph_mapmem(union ccb *ccb, struct cam_periph_map_info *mapinfo, */ mapinfo->bp[i] = uma_zalloc(pbuf_zone, M_WAITOK); - /* put our pointer in the data slot */ - mapinfo->bp[i]->b_data = *data_ptrs[i]; - - /* set the transfer length, we know it's < MAXPHYS */ - mapinfo->bp[i]->b_bufsize = lengths[i]; - /* set the direction */ mapinfo->bp[i]->b_iocmd = (dirs[i] == CAM_DIR_OUT) ? BIO_WRITE : BIO_READ; /* Map the buffer into kernel memory. */ - if (vmapbuf(mapinfo->bp[i], 1) < 0) { + if (vmapbuf(mapinfo->bp[i], *data_ptrs[i], lengths[i], 1) < 0) { uma_zfree(pbuf_zone, mapinfo->bp[i]); goto fail; } |