kamkow1/my-os-project2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix dlmalloc horror bug - mman_map overwrites application code

Browse Source
This commit is contained in:
Kamil Kowalczyk
2025-09-14 19:07:00 +02:00
parent e6891b39cc
commit 26ff717b50
18 changed files with 197 additions and 137 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
base/scripts/init.tb Normal file
View File

@ -0,0 +1 @@
print "this is an init script!"

11
kernel/bitmap/bitmap.c
View File

@ -2,8 +2,7 @@
#include <stddef.h>
#include <stdbool.h>
#include "bitmap.h"
#define DIV_ROUNDUP(num, div) ((num + div - 1) / div)
#include "util/util.h"
void *bitmap_toptr(BitMap *bm, size_t block) {
uint8_t *ptr = (uint8_t *)(bm->mem_start + (block * BITMAP_BLOCK_SIZE));
@ -17,12 +16,12 @@ size_t bitmap_toblock(BitMap *bm, void *ptr) {
size_t bitmap_toblock_roundup(BitMap *bm, void *ptr) {
uint8_t *p = ptr;
return (size_t)DIV_ROUNDUP((size_t)(p - bm->mem_start), BITMAP_BLOCK_SIZE);
return (size_t)_DIV_ROUNDUP((size_t)(p - bm->mem_start), BITMAP_BLOCK_SIZE);
}
size_t bitmap_calcsize(size_t total) {
size_t nblocks = DIV_ROUNDUP(total, BITMAP_BLOCK_SIZE);
size_t nbytes = DIV_ROUNDUP(nblocks, 8);
size_t nblocks = _DIV_ROUNDUP(total, BITMAP_BLOCK_SIZE);
size_t nbytes = _DIV_ROUNDUP(nblocks, 8);
return nbytes;
}
@ -59,7 +58,7 @@ void bitmap_markregion(BitMap *bm, void *baseptr, size_t size, bool is_used) {
if (is_used) {
base = bitmap_toblock(bm, baseptr);
size1 = DIV_ROUNDUP(size, BITMAP_BLOCK_SIZE);
size1 = _DIV_ROUNDUP(size, BITMAP_BLOCK_SIZE);
} else {
base = bitmap_toblock(bm, baseptr);
size1 = size / BITMAP_BLOCK_SIZE;

1
kernel/hal/hal.h
View File

@ -27,5 +27,6 @@ void hal_wait(uint32_t ms);
#include "x86_64/cpu.h"
#include "x86_64/intr.h"
#include "x86_64/io.h"
#include "x86_64/gdt.h"
#endif // KERNEL_HAL_HAL_H_

27
kernel/hal/x86_64/gdt.c
View File

@ -4,17 +4,12 @@
#include "hal/hal.h"
#include "gdt.h"
#define GDT_SIZE 5
#define GDT_PRESENT 0x80
#define GDT_TSS 0x89
#define KSTACK 8192
ALIGNED(16) static uint8_t kernelstack[KSTACK];
#define ISTS 7
#define ISTACK 4096
ALIGNED(16) static uint8_t iststacks[ISTS][ISTACK];
typedef struct {
uint16_t limitlow;
uint16_t baselow;
@ -35,19 +30,7 @@ typedef struct {
GdtEntry tsshigh;
} PACKED ExtendedGdt;
typedef struct {
uint32_t resv0;
uint64_t rsp0;
uint64_t rsp1;
uint64_t rsp2;
uint64_t resv1;
uint64_t ist[ISTS];
uint64_t resv2;
uint16_t resv3;
uint16_t iopb_off;
} PACKED Tss;
ALIGNED(16) static Tss tss = {0};
ALIGNED(16) Tss tss = {0};
ALIGNED(16) static ExtendedGdt gdt = {0};
void gdt_setentry(GdtEntry *ent, uint32_t base, uint32_t limit, uint8_t acc, uint8_t gran) {
@ -65,18 +48,14 @@ void gdt_init(void) {
tss.rsp0 = (uint64_t)(kernelstack + sizeof(kernelstack));
for (size_t i = 0; i < ISTS; i++) {
tss.ist[i] = (uint64_t)(iststacks[i] + sizeof(iststacks[i]));
}
uint64_t tss_base = (uint64_t)&tss;
uint32_t tss_limit = sizeof(tss) - 1;
gdt_setentry(&gdt.old[0], 0, 0, 0, 0);
gdt_setentry(&gdt.old[1], 0, 0xFFFFF, 0x9a, 0xA0);
gdt_setentry(&gdt.old[2], 0, 0xFFFFF, 0x92, 0xA0);
gdt_setentry(&gdt.old[2], 0, 0xFFFFF, 0x92, 0xC0);
gdt_setentry(&gdt.old[3], 0, 0xFFFFF, 0xfa, 0xA0);
gdt_setentry(&gdt.old[4], 0, 0xFFFFF, 0xf2, 0xA0);
gdt_setentry(&gdt.old[4], 0, 0xFFFFF, 0xf2, 0xC0);
gdt_setentry(&gdt.tsslow, tss_base & 0xFFFFFFFF, tss_limit, GDT_PRESENT | GDT_TSS, 0x0);

14
kernel/hal/x86_64/gdt.h
View File

@ -7,6 +7,20 @@
#define UDATA 0x20
#define TSS 0x28
typedef struct {
uint32_t resv0;
uint64_t rsp0;
uint64_t rsp1;
uint64_t rsp2;
uint64_t resv1;
uint64_t ist[7];
uint64_t resv2;
uint16_t resv3;
uint16_t iopb_off;
} PACKED Tss;
ALIGNED(16) extern Tss tss;
void gdt_init(void);
#endif // HAL_GDT_H_

106
kernel/hal/x86_64/intr.c
View File

@ -44,10 +44,10 @@ typedef struct {
ALIGNED(0x10) static IdtGate idtgates[ENTRIES] = {0};
static Idt idt = {0};
void idt_setentry(int i, uint64_t handler, uint8_t ist, uint8_t flags) {
void idt_setentry(int i, uint64_t handler, uint8_t flags) {
idtgates[i].intrlow = handler & 0xffff;
idtgates[i].kernelcs = KCODE;
idtgates[i].ist = ist;
idtgates[i].ist = 0;
idtgates[i].attrs = flags;
idtgates[i].intrmid = (handler >> 16) & 0xFFFF;
idtgates[i].intrhigh = (handler >> 32) & 0xFFFFFFFF;
@ -76,60 +76,60 @@ static const char *exceptions[] = {
};
void intr_init(void) {
#define MKINTR(N, IST) \
#define MKINTR(N) \
extern void intr_vec##N(void); \
idt_setentry(N, (uint64_t)&intr_vec##N, IST, 0x8E);
idt_setentry(N, (uint64_t)&intr_vec##N, 0x8E);
MKINTR(0, 0);
MKINTR(1, 0);
MKINTR(2, 2);
MKINTR(4, 0);
MKINTR(5, 0);
MKINTR(6, 0);
MKINTR(7, 0);
MKINTR(8, 1);
MKINTR(9, 0);
MKINTR(10, 0);
MKINTR(11, 0);
MKINTR(12, 0);
MKINTR(13, 0);
MKINTR(14, 0);
MKINTR(15, 0);
MKINTR(16, 0);
MKINTR(17, 0);
MKINTR(18, 0);
MKINTR(19, 0);
MKINTR(20, 0);
MKINTR(21, 0);
MKINTR(22, 0);
MKINTR(23, 0);
MKINTR(24, 0);
MKINTR(25, 0);
MKINTR(26, 0);
MKINTR(27, 0);
MKINTR(28, 0);
MKINTR(29, 0);
MKINTR(30, 0);
MKINTR(31, 0);
MKINTR(32, 0);
MKINTR(33, 0);
MKINTR(34, 0);
MKINTR(35, 0);
MKINTR(36, 0);
MKINTR(37, 0);
MKINTR(38, 0);
MKINTR(39, 0);
MKINTR(40, 3);
MKINTR(41, 0);
MKINTR(42, 0);
MKINTR(43, 0);
MKINTR(44, 0);
MKINTR(45, 0);
MKINTR(46, 0);
MKINTR(47, 0);
MKINTR(0);
MKINTR(1);
MKINTR(2);
MKINTR(4);
MKINTR(5);
MKINTR(6);
MKINTR(7);
MKINTR(8);
MKINTR(9);
MKINTR(10);
MKINTR(11);
MKINTR(12);
MKINTR(13);
MKINTR(14);
MKINTR(15);
MKINTR(16);
MKINTR(17);
MKINTR(18);
MKINTR(19);
MKINTR(20);
MKINTR(21);
MKINTR(22);
MKINTR(23);
MKINTR(24);
MKINTR(25);
MKINTR(26);
MKINTR(27);
MKINTR(28);
MKINTR(29);
MKINTR(30);
MKINTR(31);
MKINTR(32);
MKINTR(33);
MKINTR(34);
MKINTR(35);
MKINTR(36);
MKINTR(37);
MKINTR(38);
MKINTR(39);
MKINTR(40);
MKINTR(41);
MKINTR(42);
MKINTR(43);
MKINTR(44);
MKINTR(45);
MKINTR(46);
MKINTR(47);
extern void intr_vec128(void);
idt_setentry(0x80, (uint64_t)&intr_vec128, 0, 0xEE);
idt_setentry(0x80, (uint64_t)&intr_vec128, 0xEE);
idt_init();
}
@ -165,6 +165,8 @@ void hal_syscalldispatch(IntrStackFrame *frame) {
frame->regs.rax = E_BADSYSCALL;
return;
}
uint64_t cr3;
asm volatile("mov %%cr3, %0" : "=r"(cr3));
int32_t ret = fn(frame->regs.rdi, frame->regs.rsi, frame->regs.rdx,
frame->regs.r10, frame->regs.r8, frame->regs.r9);

32
kernel/proc/proc.c
View File

@ -90,8 +90,10 @@ Proc *proc_spawnkern(void (*ent)(void), char *name) {
proc->kern = true;
uint8_t *sp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE;
uint8_t *kstackp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE;
proc->platformdata.kstack = kstackp;
proc->platformdata.pstack = sp;
proc->platformdata.kstack = sp;
hal_memset(&proc->platformdata.trapframe, 0, sizeof(proc->platformdata.trapframe));
proc->platformdata.trapframe.ss = 0x10;
@ -99,7 +101,7 @@ Proc *proc_spawnkern(void (*ent)(void), char *name) {
proc->platformdata.trapframe.rflags = 0x202;
proc->platformdata.trapframe.cs = 0x08;
proc->platformdata.trapframe.rip = (uint64_t)ent;
proc->platformdata.cr3 = hal_vmm_current_cr3();
proc->platformdata.cr3 = KERNEL_CR3;
proc->state = PROC_EMBRYO;
proc->pid = pids++;
spinlock_init(&proc->bcast_pipes.spinlock);
@ -145,19 +147,22 @@ Proc *proc_spawnuser(char *mountpoint, char *path) {
uint8_t *sp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE;
uint8_t *spbase = sp - PROC_STACKSIZE;
uint8_t *kstackp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE;
proc->platformdata.kstack = kstackp;
proc->platformdata.pstack = sp;
proc->platformdata.kstack = sp;
hal_memset(&proc->platformdata.trapframe, 0, sizeof(proc->platformdata.trapframe));
proc->platformdata.cr3 = hal_vmm_userproc_pml4(proc);
uint32_t flags = HAL_PG_RW | HAL_PG_USER | HAL_PG_PRESENT;
hal_vmm_map_range(VIRT(proc->platformdata.cr3), spbase, spbase, PROC_STACKSIZE, flags);
VasRange *range = dlmalloc(sizeof(*range));
range->virtstart = spbase;
range->physstart = spbase;
range->size = PROC_STACKSIZE;
range->pgflags = flags;
LL_APPEND(proc->vas, range);
ElfAuxval aux = proc_load_elf_segs(proc, data);
@ -216,15 +221,16 @@ void proc_reaper(void) {
}
}
for (size_t i = 0; i < PROC_PIPEHANDLES_MAX; i++) {
if (zombie->pipes[i] != NULL && zombie->pipes[i]->ownerpid == zombie->pid) {
dlfree(zombie->pipes[i]);
ipc_pipefree(zombie->pipes[i]);
zombie->pipes[i] = NULL;
}
}
/* for (size_t i = 0; i < PROC_PIPEHANDLES_MAX; i++) { */
/* if (zombie->pipes[i] != NULL && zombie->pipes[i]->ownerpid == zombie->pid) { */
/* dlfree(zombie->pipes[i]); */
/* ipc_pipefree(zombie->pipes[i]); */
/* zombie->pipes[i] = NULL; */
/* } */
/* } */
pmm_free((uintptr_t)(zombie->platformdata.kstack - PROC_STACKSIZE), PROC_STACKBLOCKS);
pmm_free((uintptr_t)(zombie->platformdata.pstack - PROC_STACKSIZE), PROC_STACKBLOCKS);
if (!zombie->kern) {
VasRange *vashead = zombie->vas;
@ -258,8 +264,6 @@ void proc_reaper(void) {
}
}
extern void hal_zombiespin(void);
void proc_sched(void *cpustate) {
hal_intr_disable();
sched_ticks++;
@ -274,6 +278,7 @@ void proc_sched(void *cpustate) {
proc_reaper();
}
tss.rsp0 = (uint64_t)VIRT(PROCS.current->platformdata.kstack);
hal_switchproc(&PROCS.current->platformdata.trapframe, (void *)PROCS.current->platformdata.cr3);
}
@ -331,5 +336,6 @@ void proc_init(void) {
proc_register(init);
init->state = PROC_READY;
tss.rsp0 = (uint64_t)VIRT(PROCS.current->platformdata.kstack);
hal_switchproc(&PROCS.current->platformdata.trapframe, (void *)PROCS.current->platformdata.cr3);
}

1
kernel/proc/proc.h
View File

@ -24,6 +24,7 @@
typedef struct {
IntrStackFrame trapframe;
uint8_t *kstack;
uint8_t *pstack;
PgTable *cr3;
} ProcPlatformData;

18
share/errors.h
View File

@ -16,4 +16,22 @@ enum {
E_INVALIDOPER = -11,
};
static const char *_ERROR_STRINGS[] = {
"OK",
"Out of memory",
"Unknown filesystem type",
"No entry",
"Out of bounds access",
"Unknown storage device type",
"TODO",
"I/O error",
"System call error",
"Perform scheduling (internal flag)",
"Invalid argument",
"Invalid operation",
};
#define ERRSTRING_INDEX(ioh) ((size_t)((ioh) < 0 ? (ioh) * (-1) : (ioh)))
#define ERRSTRING(ioh) (_ERROR_STRINGS[ERRSTRING_INDEX(ioh)])
#endif // ERRORS_H_

29
ulib/_premain.c
View File

@ -5,25 +5,27 @@
#include <errors.h>
#include <dlmalloc/malloc.h>
#include <uprintf.h>
#include <log.h>
extern void main(void);
extern uint8_t _bss_start[];
extern uint8_t _bss_end[];
void clearbss(void) {
extern uint8_t _bss_start;
extern uint8_t _bss_end;
void bss_clear(void) {
uint8_t *p = _bss_start;
while (p != _bss_end) {
*p = 0;
p++;
uint8_t *ps = &_bss_start;
uint8_t *pe = &_bss_end;
size_t sz = pe - ps;
for (size_t i = 0; i < sz; i++) {
ps[i] = 0;
}
}
static char **_args;
static size_t _argslen;
char **_args;
size_t _argslen;
char **args(void) {
return _args;
return (char **)_args;
}
size_t argslen(void) {
@ -32,7 +34,7 @@ size_t argslen(void) {
// ulib initialization goes here
void _premain(void) {
bss_clear();
clearbss();
_argslen = processctl(-1, PCTL_ARGLEN, 0, 0, 0);
_args = dlmalloc(_argslen * sizeof(*_args));
@ -45,9 +47,8 @@ void _premain(void) {
return;
}
}
if (processctl(-1, PCTL_ARGV, (uint64_t)_args, _argslen, 0) != E_OK) {
return;
}
processctl(-1, PCTL_ARGV, (uint64_t)_args, _argslen, 0);
main();
}

1
ulib/_start.S
View File

@ -9,4 +9,5 @@ _start:
movq $2, %rax // sys processctl
movq $-1, %rdi // self magic num
movq $0, %rsi // kill cmd
int $0x80

36
ulib/dlmalloc/dlmalloc_port.inc
View File

@ -53,24 +53,40 @@ int INITIAL_LOCK(SpinLock *sl) {
static MLOCK_T malloc_global_mutex = { 0 };
#define PAGE_SIZE 0x1000
static uint8_t *heap_start = (uint8_t *)NULL;
static uint8_t *heap_end = NULL;
void *sbrk(long inc) {
static size_t _roundpage(size_t sz) {
return (sz + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1);
}
void *sbrk(ptrdiff_t inc) {
if (!heap_end) {
heap_end = heap_start;
}
if (inc == 0) {
return heap_end;
}
uint8_t *new_heap_end = heap_end + inc;
if (new_heap_end > heap_end) {
size_t size = new_heap_end - heap_end;
uint8_t *oldh = heap_end;
uint8_t *newh = heap_end + inc;
uint8_t *out = NULL;
int32_t ret = mman_map(heap_end, size, MMAN_MAP_PF_RW, 0, &out);
if (ret != E_OK) {
if (inc > 0) {
size_t allocsz = _roundpage((size_t)(newh - oldh));
uint8_t *maddr = NULL;
int32_t ret = mman_map(NULL, allocsz, MMAN_MAP_PF_RW, 0, &maddr);
if (ret != E_OK || maddr == NULL) {
return (void *)-1;
}
string_memset(out, 0, size);
if (!heap_start) {
heap_start = maddr;
}
heap_end = new_heap_end;
return (void *)heap_end;
oldh = heap_end ? heap_end : maddr;
heap_end = oldh + allocsz;
} else {
heap_end = newh;
}
return oldh;
}

2
ulib/syscall/syscall.c
View File

@ -21,7 +21,7 @@ uint64_t syscall(uint64_t num, uint64_t arg1, uint64_t arg2,
[ARG4]"r"(arg4),
[ARG5]"r"(arg5),
[ARG6]"r"(arg6)
: "%rax", "%rdi", "%rsi", "%rdx", "%r10", "%r8", "%r9", "memory"
: "rax", "rdi", "rsi", "rdx", "r10", "r8", "r9", "memory"
);
return ret;
}

4
ulib/system/system.c
View File

@ -2,6 +2,10 @@
#include <system/system.h>
#include <syscall/syscall.h>
#include <sysdefs/syscall.h>
#include <sysdefs/ioctl.h>
#include <sysdefs/processctl.h>
#include <sysdefs/ipcpipe.h>
#include <uprintf.h>
void debugprint(const char *string) {
syscall(SYS_DEBUGPRINT, (uint64_t)string, 0, 0, 0, 0, 0);

6
ulib/util/util.h Normal file
View File

@ -0,0 +1,6 @@
#ifndef ULIB_UTIL_UTIL_H_
#define ULIB_UTIL_UTIL_H_
#define ARRLEN(X) (sizeof((X))/sizeof((X)[0]))
#endif // ULIB_UTIL_UTIL_H_

8
user/arch/x86_64/link.ld
View File

@ -5,23 +5,23 @@ SECTIONS {
.text ALIGN(4K):
{
*(.text .text.*)
*(.text .text*)
}
.rodata (READONLY): ALIGN(4K)
{
*(.rodata .rodata.*)
*(.rodata .rodata*)
}
.data ALIGN(4K):
{
*(.data .data.*)
*(.data .data*)
}
.bss ALIGN(4K):
{
_bss_start = .;
*(.bss .bss.*)
*(.bss .bss*)
_bss_end = .;
}
}

11
user/init/main.c
View File

@ -6,16 +6,11 @@
#include <uprintf.h>
#include <ansiq/all.h>
#include <string/char.h>
void *string_memset2(void *p, int c, size_t n) {
char *cp = p;
for (size_t i = 0; i < n; i++) cp[i] = c;
return p;
}
#include <util/util.h>
void main(void) {
char *tbargs[] = { "-m", "interactive" };
int32_t tb = processctl(-1, PCTL_SPAWN, (uint64_t)"base:/bin/tb", (uint64_t)&tbargs, 2);
char *tbargs[] = { "-m", "runfile", "-f", "base:/scripts/init.tb" };
int32_t tb = processctl(-1, PCTL_SPAWN, (uint64_t)"base:/bin/tb", (uint64_t)&tbargs, ARRLEN(tbargs));
uint64_t selfpid = (uint64_t)processctl(-1, PCTL_GETPID, 0, 0, 0);
ipcpipe(tb, IPCPIPE_OUT, IPCPIPE_REPLACE, (uint8_t *)selfpid, IPCPIPE_OUT);
processctl(tb, PCTL_RUN, 0, 0, 0);

24
user/tb/main.c
View File

@ -8,16 +8,21 @@
#include <ansiq/all.h>
#include <system/system.h>
#include <sysdefs/ipcpipe.h>
#include <sysdefs/ioctl.h>
#include <sysdefs/processctl.h>
#include <errors.h>
static struct {
struct {
char *modestr;
enum { MODE_INTERACTIVE = 1, MODE_RUNFILE = 2 } mode;
char *filepath;
} CONFIG;
#define LINEBUF_MAX 1024
static Arg ARGS[] = {
ARG("-m", ARG_STRING, &CONFIG.modestr),
ARG("-f", ARG_STRING, &CONFIG.filepath),
ARG_END(),
};
@ -38,13 +43,20 @@ void set_config(void) {
} else {
CONFIG.mode = MODE_RUNFILE;
}
uprintf("CONFIG.mode = %d\n", CONFIG.mode);
}
void process_cmd(char *cmdtext) {
}
void do_file(char *filepath) {
int32_t ioh = ioctl(IOCTL_NOHANDLE, IOCTL_OPENF, (uint64_t)filepath, IOCTL_F_READ, 0);
if (ioh < 0) {
LOG(LOG_ERR, "Could not open %s: %s\n", filepath, ERRSTRING(ioh));
return;
}
}
void do_mode_interactive(void) {
char linebuf[LINEBUF_MAX];
size_t cursor;
@ -62,8 +74,6 @@ void do_mode_interactive(void) {
}
linebuf[cursor - 1] = '\0';
uprintf("\n");
process_cmd(linebuf);
}
}
@ -72,5 +82,11 @@ void main(void) {
if (CONFIG.mode == MODE_INTERACTIVE) {
do_mode_interactive();
} else if (CONFIG.mode == MODE_RUNFILE) {
if (CONFIG.filepath == NULL) {
uprintf("No file provided\n");
return;
}
do_file(CONFIG.filepath);
}
}