ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2025-01-18 18:56:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

hw: seal capability leak (fix #1568)

Browse Source 
Do not initially transfer UTCB dataspace and parent capability to a thread
that is no main thread.
This commit is contained in:
Stefan Kalkowski 2015-06-08 15:24:43 +02:00 committed by Christian Helmuth
parent fcf35a0397
commit f78aaf2234
3 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
repos/base-hw/include/base/native_types.h
View File

@ -100,7 +100,7 @@ class Genode::Native_utcb
enum { MAX_CAP_ARGS = Msgbuf_base::MAX_CAP_ARGS}; enum { MAX_CAP_ARGS = Msgbuf_base::MAX_CAP_ARGS};
enum Offsets { PARENT, UTCB_DATASPACE, THREAD_MYSELF }; enum Offsets { THREAD_MYSELF, PARENT, UTCB_DATASPACE };
private: private:

4
repos/base-hw/src/core/kernel/thread.cc
View File

@ -762,9 +762,9 @@ Core_thread::Core_thread()
Genode::map_local((addr_t)utcb, (addr_t)Genode::utcb_main_thread(), Genode::map_local((addr_t)utcb, (addr_t)Genode::utcb_main_thread(),
sizeof(Native_utcb) / Genode::get_page_size()); sizeof(Native_utcb) / Genode::get_page_size());
utcb->cap_add(cap_id_invalid());
utcb->cap_add(cap_id_invalid());
utcb->cap_add(core_capid()); utcb->cap_add(core_capid());
utcb->cap_add(cap_id_invalid());
utcb->cap_add(cap_id_invalid());
/* start thread with stack pointer at the top of stack */ /* start thread with stack pointer at the top of stack */
sp = (addr_t)&stack + DEFAULT_STACK_SIZE; sp = (addr_t)&stack + DEFAULT_STACK_SIZE;

6
repos/base-hw/src/core/platform_thread.cc
View File

@ -198,9 +198,11 @@ int Platform_thread::start(void * const ip, void * const sp)
/* reset capability counter */ /* reset capability counter */
utcb->cap_cnt(0); utcb->cap_cnt(0);
utcb->cap_add(_pd->parent().dst());
utcb->cap_add(_utcb.dst());
utcb->cap_add(_cap.dst()); utcb->cap_add(_cap.dst());
if (_main_thread) {
utcb->cap_add(_pd->parent().dst());
utcb->cap_add(_utcb.dst());
}
Kernel::start_thread(kernel_object(), cpu, _pd->kernel_pd(), Kernel::start_thread(kernel_object(), cpu, _pd->kernel_pd(),
_utcb_core_addr); _utcb_core_addr);
return 0; return 0;