xnu-2782.20.48.tar.gz

[apple/xnu.git] / osfmk / kern / exception.c

diff --git a/osfmk/kern/exception.c b/osfmk/kern/exception.c
index 8df6e268bb0dc373e61ab82ca10ed34d5660efb6..7d9cb9342386ab33bed144d116497c6ae57848e4 100644 (file)
--- a/osfmk/kern/exception.c
+++ b/osfmk/kern/exception.c
@@ -102,6 +102,12 @@ kern_return_t exception_deliver(
        struct exception_action *excp,
        lck_mtx_t                       *mutex);
 
+static kern_return_t
+check_exc_receiver_dependancy(
+       exception_type_t exception, 
+       struct exception_action *excp, 
+       lck_mtx_t *mutex);
+
 #ifdef MACH_BSD
 kern_return_t bsd_exception(
        exception_type_t        exception,
@@ -144,6 +150,19 @@ exception_deliver(
        if (!thread->active)
                return KERN_SUCCESS;
 
+       /*
+        * If there are no exception actions defined for this entity,
+        * we can't deliver here.
+        */
+       if (excp == NULL)
+               return KERN_FAILURE;
+
+       assert(exception < EXC_TYPES_COUNT);
+       if (exception >= EXC_TYPES_COUNT)
+               return KERN_FAILURE;
+
+       excp = &excp[exception];
+
        /*
         * Snapshot the exception action data under lock for consistency.
         * Hold a reference to the port over the exception_raise_* calls
@@ -283,6 +302,42 @@ exception_deliver(
        }/* switch */
 }
 
+/*
+ * Routine: check_exc_receiver_dependancy
+ * Purpose:
+ *      Verify that the port destined for receiving this exception is not
+ *      on the current task. This would cause hang in kernel for
+ *      EXC_CRASH primarily. Note: If port is transferred
+ *      between check and delivery then deadlock may happen.
+ *
+ * Conditions:
+ *             Nothing locked and no resources held.
+ *             Called from an exception context.
+ * Returns:
+ *      KERN_SUCCESS if its ok to send exception message.
+ */
+kern_return_t
+check_exc_receiver_dependancy(
+       exception_type_t exception,
+       struct exception_action *excp,
+       lck_mtx_t *mutex)
+{
+       kern_return_t retval = KERN_SUCCESS;
+
+       if (excp == NULL || exception != EXC_CRASH)
+               return retval;
+
+       task_t task = current_task();
+       lck_mtx_lock(mutex);
+       ipc_port_t xport = excp[exception].port;
+       if ( IP_VALID(xport)
+                    && ip_active(xport)
+                    && task->itk_space == xport->ip_receiver)
+               retval = KERN_FAILURE;
+       lck_mtx_unlock(mutex);
+       return retval;
+}
+
 /*
  *     Routine:        exception
  *     Purpose:
@@ -305,9 +360,8 @@ exception_triage(
        thread_t                thread;
        task_t                  task;
        host_priv_t             host_priv;
-       struct exception_action *excp;
-       lck_mtx_t                       *mutex;
-       kern_return_t           kr;
+       lck_mtx_t               *mutex;
+       kern_return_t   kr;
 
        assert(exception != EXC_RPC_ALERT);
 
@@ -317,30 +371,37 @@ exception_triage(
         * Try to raise the exception at the activation level.
         */
        mutex = &thread->mutex;
-       excp = &thread->exc_actions[exception];
-       kr = exception_deliver(thread, exception, code, codeCnt, excp, mutex);
-       if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
-               goto out;
+       if (KERN_SUCCESS == check_exc_receiver_dependancy(exception, thread->exc_actions, mutex))
+       {
+               kr = exception_deliver(thread, exception, code, codeCnt, thread->exc_actions, mutex);
+               if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
+                       goto out;
+       }
 
        /*
         * Maybe the task level will handle it.
         */
        task = current_task();
        mutex = &task->lock;
-       excp = &task->exc_actions[exception];
-       kr = exception_deliver(thread, exception, code, codeCnt, excp, mutex);
-       if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
-               goto out;
+       if (KERN_SUCCESS == check_exc_receiver_dependancy(exception, task->exc_actions, mutex))
+       {
+               kr = exception_deliver(thread, exception, code, codeCnt, task->exc_actions, mutex);
+               if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
+                       goto out;
+       }
 
        /*
         * How about at the host level?
         */
        host_priv = host_priv_self();
        mutex = &host_priv->lock;
-       excp = &host_priv->exc_actions[exception];
-       kr = exception_deliver(thread, exception, code, codeCnt, excp, mutex);
-       if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
-               goto out;
+       
+       if (KERN_SUCCESS == check_exc_receiver_dependancy(exception, host_priv->exc_actions, mutex))
+       {
+               kr = exception_deliver(thread, exception, code, codeCnt, host_priv->exc_actions, mutex);
+               if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
+                       goto out;
+       }
 
        /*
         * Nobody handled it, terminate the task.
@@ -349,7 +410,8 @@ exception_triage(
        (void) task_terminate(task);
 
 out:
-       if ((exception != EXC_CRASH) && (exception != EXC_RESOURCE))
+       if ((exception != EXC_CRASH) && (exception != EXC_RESOURCE) &&
+           (exception != EXC_GUARD))
                thread_exception_return();
        return;
 }
@@ -361,7 +423,6 @@ bsd_exception(
        mach_msg_type_number_t  codeCnt)
 {
        task_t                  task;
-       struct exception_action *excp;
        lck_mtx_t               *mutex;
        thread_t                self = current_thread();
        kern_return_t           kr;
@@ -371,9 +432,8 @@ bsd_exception(
         */
        task = current_task();
        mutex = &task->lock;
-       excp = &task->exc_actions[exception];
 
-       kr = exception_deliver(self, exception, code, codeCnt, excp, mutex);
+       kr = exception_deliver(self, exception, code, codeCnt, task->exc_actions, mutex);
 
        if (kr == KERN_SUCCESS || kr == MACH_RCV_PORT_DIED)
                return(KERN_SUCCESS);
@@ -408,7 +468,6 @@ kern_return_t task_exception_notify(exception_type_t exception,
 kern_return_t sys_perf_notify(thread_t thread, int pid) 
 {
        host_priv_t             hostp;
-       struct exception_action *excp;
        ipc_port_t              xport;
        wait_interrupt_t        wsave;
        kern_return_t           ret;
@@ -419,8 +478,7 @@ kern_return_t sys_perf_notify(thread_t thread, int pid)
        code[1] = pid;          /* Pass out the pid */
 
        struct task *task = thread->task;
-       excp = &hostp->exc_actions[EXC_RPC_ALERT];      
-       xport = excp->port;     
+       xport = hostp->exc_actions[EXC_RPC_ALERT].port; 
 
        /* Make sure we're not catching our own exception */
        if (!IP_VALID(xport) ||
@@ -436,7 +494,7 @@ kern_return_t sys_perf_notify(thread_t thread, int pid)
                        EXC_RPC_ALERT, 
                        code, 
                        2, 
-                       excp,
+                       hostp->exc_actions,
                        &hostp->lock);
        (void)thread_interrupt_level(wsave);