From owner-svn-src-all@freebsd.org Wed Dec 16 00:13:33 2020 Return-Path: Delivered-To: svn-src-all@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id 341C84A978C; Wed, 16 Dec 2020 00:13:33 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4CwbFS71qHz3Q3R; Wed, 16 Dec 2020 00:13:32 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id E40981CC76; Wed, 16 Dec 2020 00:13:32 +0000 (UTC) (envelope-from jhb@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id 0BG0DW6R040705; Wed, 16 Dec 2020 00:13:32 GMT (envelope-from jhb@FreeBSD.org) Received: (from jhb@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id 0BG0DWXn040704; Wed, 16 Dec 2020 00:13:32 GMT (envelope-from jhb@FreeBSD.org) Message-Id: <202012160013.0BG0DWXn040704@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: jhb set sender to jhb@FreeBSD.org using -f From: John Baldwin Date: Wed, 16 Dec 2020 00:13:32 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r368686 - head/sys/dev/mrsas X-SVN-Group: head X-SVN-Commit-Author: jhb X-SVN-Commit-Paths: head/sys/dev/mrsas X-SVN-Commit-Revision: 368686 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-all@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: "SVN commit messages for the entire src tree \(except for " user" and " projects" \)" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 16 Dec 2020 00:13:33 -0000 Author: jhb Date: Wed Dec 16 00:13:32 2020 New Revision: 368686 URL: https://svnweb.freebsd.org/changeset/base/368686 Log: Use uintptr_t instead of unsigned long for pointers. The sense_ptr thing is quite broken. As near as I can tell, the driver tries to copyout to a physical address rather than whatever user address the sense buffer should be copied to. It is not immediately obvious what user address the sense buffer should be copied to. Reviewed by: imp Obtained from: CheriBSD Sponsored by: DARPA Differential Revision: https://reviews.freebsd.org/D27578 Modified: head/sys/dev/mrsas/mrsas_ioctl.c Modified: head/sys/dev/mrsas/mrsas_ioctl.c ============================================================================== --- head/sys/dev/mrsas/mrsas_ioctl.c Wed Dec 16 00:11:30 2020 (r368685) +++ head/sys/dev/mrsas/mrsas_ioctl.c Wed Dec 16 00:13:32 2020 (r368686) @@ -136,7 +136,7 @@ mrsas_passthru(struct mrsas_softc *sc, void *arg, u_lo * iocpacket itself. */ kern_sge32 = (struct mrsas_sge32 *) - ((unsigned long)cmd->frame + user_ioc->sgl_off); + ((uintptr_t)cmd->frame + user_ioc->sgl_off); memset(ioctl_data_tag, 0, (sizeof(bus_dma_tag_t) * MAX_IOCTL_SGE)); memset(ioctl_data_dmamap, 0, (sizeof(bus_dmamap_t) * MAX_IOCTL_SGE)); @@ -243,7 +243,7 @@ mrsas_passthru(struct mrsas_softc *sc, void *arg, u_lo goto out; } sense_ptr = - (unsigned long *)((unsigned long)cmd->frame + user_ioc->sense_off); + (unsigned long *)((uintptr_t)cmd->frame + user_ioc->sense_off); *sense_ptr = ioctl_sense_phys_addr; } /* @@ -290,9 +290,9 @@ mrsas_passthru(struct mrsas_softc *sc, void *arg, u_lo * sense_buff points to the location that has the user sense * buffer address */ - sense_ptr = (unsigned long *)((unsigned long)user_ioc->frame.raw + + sense_ptr = (unsigned long *)((uintptr_t)user_ioc->frame.raw + user_ioc->sense_off); - ret = copyout(ioctl_sense_mem, (unsigned long *)*sense_ptr, + ret = copyout(ioctl_sense_mem, (unsigned long *)(uintptr_t)*sense_ptr, user_ioc->sense_len); if (ret) { device_printf(sc->mrsas_dev, "IOCTL sense copyout failed!\n");