userspace: easy checking for specific driver #12056
Conversation
In general driver system calls are implemented at a subsystem layer. However, some drivers may have capabilities specific to the hardware not covered by the subsystem API. Such drivers may want to define their own system calls. This macro makes it simple to validate in the driver-specific system call handlers that not only does the untrusted device pointer correspond to the expected subsystem, initialization state, and caller permissions, but also that the device object is an instance of a specific driver (and not just any driver in that subsystem). Signed-off-by: Andrew Boie <andrew.p.boie@intel.com>
andrewboie
requested review from
agross-oss,
andyross,
ceolin,
ioannisg and
pabigot
pabigot
left a comment
pabigot
left a comment
There was a problem hiding this comment.
Seems plausible, but I won't have a chance to test it until next week.
Codecov Report
@@ Coverage Diff @@
## master #12056 +/- ##
=======================================
Coverage 48.05% 48.05%
=======================================
Files 281 281
Lines 43414 43414
Branches 10404 10404
=======================================
Hits 20862 20862
Misses 18403 18403
Partials 4149 4149Continue to review full report at Codecov.
|
|
recheck |
andyross
left a comment
andyross
left a comment
There was a problem hiding this comment.
Yup. Better than ioctl().
| a provided pointer is a valid instance of a specific device driver, that | ||
| the calling thread has permissions on it, and that the driver has been | ||
| initialized. It does this by checking the init function pointer that | ||
| is stored within the driver instance and ensuring that it matches the |
There was a problem hiding this comment.
I don't think "by ensuring" would be correct. The ensuring is part of the checking that's already under "by". Perhaps:
It does this by checking that the init function pointer stored within the driver instance matches the provided value, which should be the address of the specific driver's init function.
9 participants
In general driver system calls are implemented at a subsystem
layer. However, some drivers may have capabilities specific to
the hardware not covered by the subsystem API. Such drivers may
want to define their own system calls.
This macro makes it simple to validate in the driver-specific
system call handlers that not only does the untrusted device
pointer correspond to the expected subsystem, initialization
state, and caller permissions, but also that the device object
is an instance of a specific driver (and not just any driver in
that subsystem).
Signed-off-by: Andrew Boie andrew.p.boie@intel.com