Re: [PATCH gnumach] pmap: Fix out of bounds mapwindow when using full NCPUS

[Samuel Thibault]

Damien Zammit, le sam. 05 août 2023 15:49:36 +0000, a ecrit:
> There are only two slots per cpu. Use only one of two per cpu.

Well, yes, that's what the code was already doing.

> ---
>  i386/intel/pmap.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/i386/intel/pmap.c b/i386/intel/pmap.c
> index 0bb1a490..9bcbc279 100644
> --- a/i386/intel/pmap.c
> +++ b/i386/intel/pmap.c
> @@ -1020,10 +1020,10 @@ pmap_mapwindow_t *pmap_get_mapwindow(pt_entry_t entry)
>       assert(entry != 0);
>  
>       /* Find an empty one.  */
> -     for (map = &mapwindows[cpu * PMAP_NMAPWINDOWS]; map < 
> &mapwindows[(cpu+1) * PMAP_NMAPWINDOWS]; map++)
> +     for (map = &mapwindows[cpu]; map < &mapwindows[cpu+1 + NCPUS]; map += 
> NCPUS)

We don't want to hardcode "+1". And better use adjacent entries for the
same cpu. I don't see which issue you had seen with the previous code.

>               if (!(*map->entry))
>                       break;
> -     assert(map < &mapwindows[(cpu+1) * PMAP_NMAPWINDOWS]);
> +     assert(map < &mapwindows[(cpu+1) + NCPUS]);
>  
>  #ifdef MACH_PV_PAGETABLES
>       if (!hyp_mmu_update_pte(kv_to_ma(map->entry), pa_to_ma(entry)))
> -- 
> 2.40.1