From 8edbf305d54e4f20446f8c2bc0b4cbe9317af367 Mon Sep 17 00:00:00 2001 From: Ted Unangst Date: Mon, 23 May 2016 15:22:46 +0000 Subject: remove the function pointer from mbufs. this memory is shared with data via unions, and we don't want to make it easy to control the target. instead an integer index into an array of acceptable functions is used. drivers using custom functions must register them to receive an index. ok deraadt --- sys/kern/uipc_mbuf.c | 29 ++++++++++++++++++++++++----- 1 file changed, 24 insertions(+), 5 deletions(-) (limited to 'sys/kern') diff --git a/sys/kern/uipc_mbuf.c b/sys/kern/uipc_mbuf.c index b84d42ea1ea..951c474811e 100644 --- a/sys/kern/uipc_mbuf.c +++ b/sys/kern/uipc_mbuf.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uipc_mbuf.c,v 1.224 2016/04/15 05:05:21 dlg Exp $ */ +/* $OpenBSD: uipc_mbuf.c,v 1.225 2016/05/23 15:22:44 tedu Exp $ */ /* $NetBSD: uipc_mbuf.c,v 1.15.4.1 1996/06/13 17:11:44 cgd Exp $ */ /* @@ -130,6 +130,8 @@ struct mbuf *m_copym0(struct mbuf *, int, int, int, int); void nmbclust_update(void); void m_zero(struct mbuf *); +static void (*mextfree_fns[4])(caddr_t, u_int, void *); +static u_int num_extfree_fns; const char *mclpool_warnmsg = "WARNING: mclpools limit reached; increase kern.maxclusters"; @@ -168,6 +170,9 @@ mbinit(void) pool_setlowat(&mclpools[i], mcllowat); } + (void)mextfree_register(m_extfree_pool); + KASSERT(num_extfree_fns == 1); + nmbclust_update(); } @@ -331,7 +336,7 @@ m_clget(struct mbuf *m, int how, u_int pktlen) return (NULL); } - MEXTADD(m, buf, pp->pr_size, M_EXTWR, m_extfree_pool, pp); + MEXTADD(m, buf, pp->pr_size, M_EXTWR, MEXTFREE_POOL, pp); return (m); } @@ -414,11 +419,25 @@ m_extunref(struct mbuf *m) return (refs); } +/* + * Returns a number for use with MEXTADD. + * Should only be called once per function. + * Drivers can be assured that the index will be non zero. + */ +u_int +mextfree_register(void (*fn)(caddr_t, u_int, void *)) +{ + KASSERT(num_extfree_fns < nitems(mextfree_fns)); + mextfree_fns[num_extfree_fns] = fn; + return num_extfree_fns++; +} + void m_extfree(struct mbuf *m) { if (m_extunref(m) == 0) { - (*(m->m_ext.ext_free))(m->m_ext.ext_buf, + KASSERT(m->m_ext.ext_free_fn < num_extfree_fns); + mextfree_fns[m->m_ext.ext_free_fn](m->m_ext.ext_buf, m->m_ext.ext_size, m->m_ext.ext_arg); } @@ -1317,8 +1336,8 @@ m_print(void *v, if (m->m_flags & M_EXT) { (*pr)("m_ext.ext_buf: %p\tm_ext.ext_size: %u\n", m->m_ext.ext_buf, m->m_ext.ext_size); - (*pr)("m_ext.ext_free: %p\tm_ext.ext_arg: %p\n", - m->m_ext.ext_free, m->m_ext.ext_arg); + (*pr)("m_ext.ext_free_fn: %u\tm_ext.ext_arg: %p\n", + m->m_ext.ext_free_fn, m->m_ext.ext_arg); (*pr)("m_ext.ext_nextref: %p\tm_ext.ext_prevref: %p\n", m->m_ext.ext_nextref, m->m_ext.ext_prevref); -- cgit v1.2.3