Add magic number and bounds checking...

... for event channel and grant table descriptors.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

diff --git a/src/xenbus/evtchn.c b/src/xenbus/evtchn.c
index 15f53e0619f36ff30487aebbcb7bfe41731e09ee..7a8714678381e6f52439205cb3f0cd010cb5f8ab 100644 (file)
--- a/src/xenbus/evtchn.c
+++ b/src/xenbus/evtchn.c
@@ -72,7 +72,10 @@ typedef struct _EVTCHN_PARAMETERS {
 
 #pragma warning(pop)
 
+#define EVTCHN_DESCRIPTOR_MAGIC 'DTVE'
+
 struct _XENBUS_EVTCHN_DESCRIPTOR {
+    ULONG                               Magic;
     LIST_ENTRY                          ListEntry;
     PVOID                               Caller;
     PKSERVICE_ROUTINE                   Callback;
@@ -286,6 +289,8 @@ EvtchnOpen(
     if (Descriptor == NULL)
         goto fail1;
 
+    Descriptor->Magic = EVTCHN_DESCRIPTOR_MAGIC;
+
     (VOID) RtlCaptureStackBackTrace(1, 1, &Descriptor->Caller, NULL);    
 
     Descriptor->Type = Type;
@@ -321,6 +326,8 @@ EvtchnOpen(
 
     LocalPort = Descriptor->LocalPort;
 
+    ASSERT3U(LocalPort, <, sizeof (Context->Descriptor) / sizeof (Context->Descriptor[0]));
+
     (VOID) __AcquireInterruptLock(Context->InterruptObject);
 
     ASSERT3P(Context->Descriptor[LocalPort], ==, NULL);
@@ -344,6 +351,8 @@ fail2:
 
     Descriptor->Caller = NULL;
 
+    Descriptor->Magic = 0;
+
     ASSERT(IsZeroMemory(Descriptor, sizeof (XENBUS_EVTCHN_DESCRIPTOR)));
     __EvtchnFree(Descriptor);
 
@@ -368,6 +377,8 @@ EvtchnUnmask(
     KIRQL                           Irql;
     BOOLEAN                         Pending;
 
+    ASSERT3U(Descriptor->Magic, ==, EVTCHN_DESCRIPTOR_MAGIC);
+
     if (!Locked)
         Irql = __AcquireInterruptLock(Context->InterruptObject);
 
@@ -428,6 +439,8 @@ EvtchnSend(
 
     UNREFERENCED_PARAMETER(Context);
 
+    ASSERT3U(Descriptor->Magic, ==, EVTCHN_DESCRIPTOR_MAGIC);
+
     // Make sure we don't suspend
     KeRaiseIrql(DISPATCH_LEVEL, &Irql);
 
@@ -471,6 +484,8 @@ EvtchnTrigger(
     KIRQL                           Irql;
     BOOLEAN                         DoneSomething;
 
+    ASSERT3U(Descriptor->Magic, ==, EVTCHN_DESCRIPTOR_MAGIC);
+
     Irql = __AcquireInterruptLock(Context->InterruptObject);
 
     if (Descriptor->Active) {
@@ -494,6 +509,8 @@ EvtchnClose(
 {
     KIRQL                           Irql;
 
+    ASSERT3U(Descriptor->Magic, ==, EVTCHN_DESCRIPTOR_MAGIC);
+
     Irql = __AcquireInterruptLock(Context->InterruptObject);
 
     RemoveEntryList(&Descriptor->ListEntry);
@@ -502,6 +519,8 @@ EvtchnClose(
     if (Descriptor->Active) {
         ULONG   LocalPort = Descriptor->LocalPort;
 
+        ASSERT3U(LocalPort, <, sizeof (Context->Descriptor) / sizeof (Context->Descriptor[0]));
+
         Descriptor->Active = FALSE;
 
         SHARED_INFO(EvtchnMask,
@@ -527,6 +546,8 @@ EvtchnClose(
 
     Descriptor->Caller = NULL;
 
+    Descriptor->Magic = 0;
+
     ASSERT(IsZeroMemory(Descriptor, sizeof (XENBUS_EVTCHN_DESCRIPTOR)));
     __EvtchnFree(Descriptor);
 }
@@ -539,6 +560,7 @@ EvtchnPort(
 {
     UNREFERENCED_PARAMETER(Context);
 
+    ASSERT3U(Descriptor->Magic, ==, EVTCHN_DESCRIPTOR_MAGIC);
     ASSERT(Descriptor->Active);
 
     return Descriptor->LocalPort;
@@ -690,6 +712,8 @@ EvtchnSuspendCallbackEarly(
         if (Descriptor->Active) {
             ULONG   LocalPort = Descriptor->LocalPort;
 
+            ASSERT3U(LocalPort, <, sizeof (Context->Descriptor) / sizeof (Context->Descriptor[0]));
+
             Descriptor->Active = FALSE;
 
             ASSERT(Context->Descriptor[LocalPort] != NULL);

diff --git a/src/xenbus/gnttab.c b/src/xenbus/gnttab.c
index 9c220a728fb7cf4af7f39ce235e2978b9c412d1b..a028faf1208f39a5131fad26c4fef12646588af4 100644 (file)
--- a/src/xenbus/gnttab.c
+++ b/src/xenbus/gnttab.c
@@ -49,7 +49,10 @@
 // we also reserve 1 entry for the crash kernel
 #define GNTTAB_RESERVED_ENTRY_COUNT 9
 
+#define GNTTAB_DESCRIPTOR_MAGIC 'DTNG'
+
 struct _XENBUS_GNTTAB_DESCRIPTOR {
+    ULONG               Magic;
     ULONG               Reference;
     grant_entry_v1_t    Entry;
 };
@@ -96,8 +99,8 @@ __GnttabExpand(
 {
     ULONG                       FrameIndex;
     PFN_NUMBER                  Pfn;
-    ULONGLONG                   Start;
-    ULONGLONG                   End;
+    LONGLONG                    Start;
+    LONGLONG                    End;
     NTSTATUS                    status;
 
     FrameIndex = Context->FrameCount;
@@ -119,7 +122,7 @@ __GnttabExpand(
     Start = __max(GNTTAB_RESERVED_ENTRY_COUNT, FrameIndex * GNTTAB_ENTRY_PER_FRAME);
     End = (Context->FrameCount * GNTTAB_ENTRY_PER_FRAME) - 1;
 
-    Trace("adding refrences [%08llx - %08llx]\n", Start, End);
+    Info("adding refrences [%08llx - %08llx]\n", Start, End);
 
     RangeSetPut(Context->RangeSet, Start, End);
 
@@ -154,8 +157,12 @@ done:
     if (!NT_SUCCESS(status))
         goto fail2;
 
+    Descriptor->Magic = GNTTAB_DESCRIPTOR_MAGIC;
     Descriptor->Reference = (ULONG)Reference;
 
+    ASSERT3U(Descriptor->Reference, >=, GNTTAB_RESERVED_ENTRY_COUNT);
+    ASSERT3U(Descriptor->Reference, <, Context->FrameCount * GNTTAB_ENTRY_PER_FRAME);
+
     return STATUS_SUCCESS;
 
 fail2:
@@ -177,9 +184,11 @@ GnttabDescriptorDtor(
     PXENBUS_GNTTAB_DESCRIPTOR   Descriptor = Object;
     NTSTATUS                    status;
 
+    ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
+
     status = RangeSetPut(Context->RangeSet,
-                         (ULONGLONG)Descriptor->Reference,
-                         (ULONGLONG)Descriptor->Reference);
+                         (LONGLONG)Descriptor->Reference,
+                         (LONGLONG)Descriptor->Reference);
     ASSERT(NT_SUCCESS(status));
 }
 
@@ -264,13 +273,13 @@ __GnttabEmpty(
     IN  PXENBUS_GNTTAB_CONTEXT  Context
     )
 {
-    ULONGLONG                   Entry;
+    LONGLONG                    Entry;
 
     PoolTeardown(Context->DescriptorPool);
     Context->DescriptorPool = NULL;
 
     for (Entry = GNTTAB_RESERVED_ENTRY_COUNT;
-         Entry < Context->FrameCount * GNTTAB_ENTRY_PER_FRAME;
+         Entry < (LONGLONG)(Context->FrameCount * GNTTAB_ENTRY_PER_FRAME);
          Entry++) {
         NTSTATUS    status;
 
@@ -293,6 +302,8 @@ GnttabGet(
 
     if (Descriptor == NULL)
         (VOID) InterlockedIncrement(&Context->GetFailed);
+    else
+        ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
 
     return Descriptor;
 }
@@ -303,6 +314,8 @@ GnttabPut(
     IN  PXENBUS_GNTTAB_DESCRIPTOR   Descriptor
     )
 {
+    ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
+
     PoolPut(Context->DescriptorPool, Descriptor, FALSE);
 }
 
@@ -352,6 +365,10 @@ GnttabPermitForeignAccess(
     va_list                         Arguments;
     NTSTATUS                        status;
 
+    ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
+    ASSERT3U(Descriptor->Reference, >=, GNTTAB_RESERVED_ENTRY_COUNT);
+    ASSERT3U(Descriptor->Reference, <, Context->FrameCount * GNTTAB_ENTRY_PER_FRAME);
+
     va_start(Arguments, Type);
     switch (Type) {
     case GNTTAB_ENTRY_FULL_PAGE:
@@ -378,6 +395,10 @@ GnttabRevokeForeignAccess(
     ULONG                           Attempt;
     NTSTATUS                        status;
 
+    ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
+    ASSERT3U(Descriptor->Reference, >=, GNTTAB_RESERVED_ENTRY_COUNT);
+    ASSERT3U(Descriptor->Reference, <, Context->FrameCount * GNTTAB_ENTRY_PER_FRAME);
+
     Entry = &Context->Entry[Descriptor->Reference];
     Flags = (volatile SHORT *)&Entry->flags;
 
@@ -420,6 +441,10 @@ GnttabReference(
 {
     UNREFERENCED_PARAMETER(Context);
 
+    ASSERT3U(Descriptor->Magic, ==, GNTTAB_DESCRIPTOR_MAGIC);
+    ASSERT3U(Descriptor->Reference, >=, GNTTAB_RESERVED_ENTRY_COUNT);
+    ASSERT3U(Descriptor->Reference, <, Context->FrameCount * GNTTAB_ENTRY_PER_FRAME);
+
     return (ULONG)Descriptor->Reference;
 }