Skip to content

X
xv6-public
提交 bd228a81 创建 作者: rtm's avatar rtm
浏览文件
操作

prevent longjmp / forkret from writing over tf->edi

上级 0dd42537
隐藏空白字符变更
内嵌 并排
正在显示 包含 9 行增加 和 6 行删除
pipe.c
浏览文件 @ bd228a81
...@@ -61,6 +61,8 @@ pipe_alloc(struct fd **fd1, struct fd **fd2) ...@@ -61,6 +61,8 @@ pipe_alloc(struct fd **fd1, struct fd **fd2)
void void
pipe_close(struct pipe *p, int writeable) pipe_close(struct pipe *p, int writeable)
{ {
acquire(&p->lock);
if(writeable){ if(writeable){
p->writeopen = 0; p->writeopen = 0;
wakeup(&p->readp); wakeup(&p->readp);
...@@ -68,6 +70,9 @@ pipe_close(struct pipe *p, int writeable) ...@@ -68,6 +70,9 @@ pipe_close(struct pipe *p, int writeable)
p->readopen = 0; p->readopen = 0;
wakeup(&p->writep); wakeup(&p->writep);
} }
release(&p->lock);
if(p->readopen == 0 && p->writeopen == 0) if(p->readopen == 0 && p->writeopen == 0)
kfree((char *) p, PAGE); kfree((char *) p, PAGE);
} }
......
proc.c
浏览文件 @ bd228a81
...@@ -109,7 +109,7 @@ copyproc(struct proc* p) ...@@ -109,7 +109,7 @@ copyproc(struct proc* p)
// Set up new jmpbuf to start executing at forkret (see below). // Set up new jmpbuf to start executing at forkret (see below).
memset(&np->jmpbuf, 0, sizeof np->jmpbuf); memset(&np->jmpbuf, 0, sizeof np->jmpbuf);
np->jmpbuf.eip = (uint)forkret; np->jmpbuf.eip = (uint)forkret;
np->jmpbuf.esp = (uint)np->tf; np->jmpbuf.esp = (uint)np->tf - 4;
// Copy file descriptors // Copy file descriptors
for(i = 0; i < NOFILE; i++){ for(i = 0; i < NOFILE; i++){
......
syscall.c
浏览文件 @ bd228a81
...@@ -13,8 +13,7 @@ ...@@ -13,8 +13,7 @@
* System call number in %eax. * System call number in %eax.
* Arguments on the stack, from the user call to the C * Arguments on the stack, from the user call to the C
* library system call function. The saved user %esp points * library system call function. The saved user %esp points
* to a saved frame pointer, a program counter, and then * to a saved program counter, and then the first argument.
* the first argument.
* *
* Return value? Error indication? Errno? * Return value? Error indication? Errno?
*/ */
...@@ -56,11 +55,11 @@ fetcharg(int argno, void *ip) ...@@ -56,11 +55,11 @@ fetcharg(int argno, void *ip)
} }
int int
putint(struct proc *p, uint addr, int ip) putint(struct proc *p, uint addr, int x)
{ {
if(addr > p->sz - 4) if(addr > p->sz - 4)
return -1; return -1;
memmove(p->mem + addr, &ip, 4); memmove(p->mem + addr, &x, 4);
return 0; return 0;
} }
...@@ -269,7 +268,6 @@ syscall(void) ...@@ -269,7 +268,6 @@ syscall(void)
int num = cp->tf->eax; int num = cp->tf->eax;
int ret = -1; int ret = -1;
//cprintf("%x sys %d\n", cp, num);
switch(num){ switch(num){
case SYS_fork: case SYS_fork:
ret = sys_fork(); ret = sys_fork();
......
您添加了 0 人 到此讨论。请谨慎行事。
请先完成此评论的编辑！
请 注册 或者 后发表评论