if_urndis: Organize buffer layouts more naturally

[markj]

Summary

• Group the request header and I/O buffer in one structure, rather than assuming that both request structures have the same size.
• Pass a pointer to the whole structure to urndis_ctrl_query() and urndis_ctrl_set() rather than just the header. This way, on CHERI platforms, the compiler will set bounds as intended. Otherwise, on CHERI platforms these functions violate subobject bounds since they modify the buffer following the header.

While here, there is no apparent reason for the request structure used
in urndis_attach() to be allocated statically. Change it so that it's
allocated on the stack.

[jrtc27]

Re:

on CHERI platforms, the compiler will set bounds as intended

Note this is because CheriBSD opts into subobject bounds for the kernel due to the history of intra-object overflows; by default this would not be an issue for CHERI.

[markj]

In D45866#1045792, @jrtc27 wrote:

Re:

on CHERI platforms, the compiler will set bounds as intended

Note this is because CheriBSD opts into subobject bounds for the kernel due to the history of intra-object overflows; by default this would not be an issue for CHERI.

I see, I hadn't seen that the purecap kernel configs explicitly configure subobject bounds.

[jhb]

I would be tempted to leave out the casts for the upstream patch for now and instead just do the union cleanup perhaps? But I'm fine either way.

[markj]

In D45866#1047003, @jhb wrote:

I would be tempted to leave out the casts for the upstream patch for now and instead just do the union cleanup perhaps? But I'm fine either way.

Without the casts, I need to pass &foo.hdr, sizeof(foo) to the subroutines, which also looks a bit dubious to me. I think I prefer to just keep it as it is.