xnu-4570.31.3.tar.gz

[apple/xnu.git] / iokit / Kernel / IOUserClient.cpp

diff --git a/iokit/Kernel/IOUserClient.cpp b/iokit/Kernel/IOUserClient.cpp
index 6cd4737c5602f794821c6ee881e6ad469b7456c0..6a3fc814b113beef0832682348598ed16ae60df8 100644 (file)
--- a/iokit/Kernel/IOUserClient.cpp
+++ b/iokit/Kernel/IOUserClient.cpp
@@ -37,6 +37,7 @@
 #include <IOKit/IOMemoryDescriptor.h>
 #include <IOKit/IOBufferMemoryDescriptor.h>
 #include <IOKit/IOLib.h>
 #include <IOKit/IOMemoryDescriptor.h>
 #include <IOKit/IOBufferMemoryDescriptor.h>
 #include <IOKit/IOLib.h>

+#include <IOKit/IOBSD.h>

 #include <IOKit/IOStatisticsPrivate.h>
 #include <IOKit/IOTimeStamp.h>
 #include <IOKit/system.h>
 #include <IOKit/IOStatisticsPrivate.h>
 #include <IOKit/IOTimeStamp.h>
 #include <IOKit/system.h>


@@ -646,6 +647,7 @@ public:
                        void * reference, vm_size_t referenceSize,
                       bool clientIs64 );
     virtual void free() APPLE_KEXT_OVERRIDE;
                        void * reference, vm_size_t referenceSize,
                       bool clientIs64 );
     virtual void free() APPLE_KEXT_OVERRIDE;

+    void invalidatePort(void);

 
     static bool _handler( void * target,
                           void * ref, IOService * newService, IONotifier * notifier );
 
     static bool _handler( void * target,
                           void * ref, IOService * newService, IONotifier * notifier );


@@ -679,6 +681,7 @@ public:
                       bool clientIs64 );
 
     virtual void free() APPLE_KEXT_OVERRIDE;
                       bool clientIs64 );
 
     virtual void free() APPLE_KEXT_OVERRIDE;

+    void invalidatePort(void);

     
     static IOReturn _handler( void * target, void * ref,
                               UInt32 messageType, IOService * provider,
     
     static IOReturn _handler( void * target, void * ref,
                               UInt32 messageType, IOService * provider,


@@ -784,6 +787,11 @@ bool IOServiceUserNotification::init( mach_port_t port, natural_t type,
     return( true );
 }
 
     return( true );
 }
 

+void IOServiceUserNotification::invalidatePort(void)
+{
+    if (pingMsg) pingMsg->msgHdr.msgh_remote_port = MACH_PORT_NULL;
+}
+

 void IOServiceUserNotification::free( void )
 {
     PingMsg   *        _pingMsg;
 void IOServiceUserNotification::free( void )
 {
     PingMsg   *        _pingMsg;


@@ -940,6 +948,11 @@ bool IOServiceMessageUserNotification::init( mach_port_t port, natural_t type,
     return( true );
 }
 
     return( true );
 }
 

+void IOServiceMessageUserNotification::invalidatePort(void)
+{
+    if (pingMsg) pingMsg->msgHdr.msgh_remote_port = MACH_PORT_NULL;
+}
+

 void IOServiceMessageUserNotification::free( void )
 {
     PingMsg *  _pingMsg;
 void IOServiceMessageUserNotification::free( void )
 {
     PingMsg *  _pingMsg;


@@ -993,9 +1006,9 @@ IOReturn IOServiceMessageUserNotification::handler( void * ref,
     }
     else
     {
     }
     else
     {

+        if( callerArgSize > kIOUserNotifyMaxMessageSize)
+            callerArgSize = kIOUserNotifyMaxMessageSize;

         argSize = callerArgSize;
         argSize = callerArgSize;

-        if( argSize > kIOUserNotifyMaxMessageSize)
-            argSize = kIOUserNotifyMaxMessageSize;

     }
 
     // adjust message size for ipc restrictions
     }
 
     // adjust message size for ipc restrictions


@@ -1617,7 +1630,7 @@ IOMemoryMap * IOUserClient::mapClientMemory64(
 {
     IOReturn           err;
     IOOptionBits       options = 0;
 {
     IOReturn           err;
     IOOptionBits       options = 0;

-    IOMemoryDescriptor * memory;
+    IOMemoryDescriptor * memory = 0;

     IOMemoryMap *      map = 0;
 
     err = clientMemoryForType( (UInt32) type, &options, &memory );
     IOMemoryMap *      map = 0;
 
     err = clientMemoryForType( (UInt32) type, &options, &memory );


@@ -1921,38 +1934,36 @@ kern_return_t is_io_object_get_superclass(
        io_name_t obj_name, 
        io_name_t class_name)
 {
        io_name_t obj_name, 
        io_name_t class_name)
 {

-       const OSMetaClass* my_obj = NULL;
-       const OSMetaClass* superclass = NULL;
-       const OSSymbol *my_name = NULL;
-       const char *my_cstr = NULL;
+    IOReturn            ret;
+    const OSMetaClass * meta;
+    const OSMetaClass * super;
+    const OSSymbol    * name;
+    const char        * cstr;

 
 

-       if (!obj_name || !class_name) 
-               return (kIOReturnBadArgument);
+    if (!obj_name || !class_name)          return (kIOReturnBadArgument);
+    if (master_port != master_device_port) return( kIOReturnNotPrivileged);

 
 

-    if( master_port != master_device_port)
-        return( kIOReturnNotPrivileged);
+    ret = kIOReturnNotFound;
+    meta = 0;
+    do
+    {
+        name = OSSymbol::withCString(obj_name);
+        if (!name) break;
+        meta = OSMetaClass::copyMetaClassWithName(name);
+        if (!meta) break;
+        super = meta->getSuperClass();
+        if (!super) break;
+        cstr = super->getClassName();
+        if (!cstr) break;
+        strlcpy(class_name, cstr, sizeof(io_name_t));
+        ret = kIOReturnSuccess;
+    }
+    while (false);

 
 

-       my_name = OSSymbol::withCString(obj_name);
-       
-       if (my_name) {
-               my_obj = OSMetaClass::getMetaClassWithName(my_name);
-               my_name->release();
-       }
-       if (my_obj) {
-               superclass = my_obj->getSuperClass();
-       }
-       
-       if (!superclass)  {
-               return( kIOReturnNotFound );
-       }
+    OSSafeReleaseNULL(name);
+    if (meta) meta->releaseMetaClass();

 
 

-       my_cstr = superclass->getClassName();
-               
-       if (my_cstr) {
-               strlcpy(class_name, my_cstr, sizeof(io_name_t));
-               return( kIOReturnSuccess );
-       }
-       return (kIOReturnNotFound);
+    return (ret);

 }
 
 /* Routine io_object_get_bundle_identifier */
 }
 
 /* Routine io_object_get_bundle_identifier */


@@ -1961,38 +1972,36 @@ kern_return_t is_io_object_get_bundle_identifier(
        io_name_t obj_name, 
        io_name_t bundle_name)
 {
        io_name_t obj_name, 
        io_name_t bundle_name)
 {

-       const OSMetaClass* my_obj = NULL;
-       const OSSymbol *my_name = NULL;
-       const OSSymbol *identifier = NULL;
-       const char *my_cstr = NULL;
+    IOReturn            ret;
+    const OSMetaClass * meta;
+    const OSSymbol    * name;
+    const OSSymbol    * identifier;
+    const char        * cstr;

 
 

-       if (!obj_name || !bundle_name) 
-               return (kIOReturnBadArgument);
+    if (!obj_name || !bundle_name)         return (kIOReturnBadArgument);
+    if (master_port != master_device_port) return( kIOReturnNotPrivileged);

 
 

-    if( master_port != master_device_port)
-        return( kIOReturnNotPrivileged);
-       
-       my_name = OSSymbol::withCString(obj_name);      
-       
-       if (my_name) {
-               my_obj = OSMetaClass::getMetaClassWithName(my_name);
-               my_name->release();
-       }
+    ret = kIOReturnNotFound;
+    meta = 0;
+    do
+    {
+        name = OSSymbol::withCString(obj_name);
+        if (!name) break;
+        meta = OSMetaClass::copyMetaClassWithName(name);
+        if (!meta) break;
+        identifier = meta->getKmodName();
+        if (!identifier) break;
+        cstr = identifier->getCStringNoCopy();
+        if (!cstr) break;
+        strlcpy(bundle_name, identifier->getCStringNoCopy(), sizeof(io_name_t));
+        ret = kIOReturnSuccess;
+    }
+    while (false);

 
 

-       if (my_obj) {
-               identifier = my_obj->getKmodName();
-       }
-       if (!identifier) {
-               return( kIOReturnNotFound );
-       }
-       
-       my_cstr = identifier->getCStringNoCopy();
-       if (my_cstr) {
-               strlcpy(bundle_name, identifier->getCStringNoCopy(), sizeof(io_name_t));
-               return( kIOReturnSuccess );
-       }
+    OSSafeReleaseNULL(name);
+    if (meta) meta->releaseMetaClass();

 
 

-       return (kIOReturnBadArgument);
+    return (ret);

 }
 
 /* Routine io_object_conforms_to */
 }
 
 /* Routine io_object_conforms_to */


@@ -2311,6 +2320,8 @@ static kern_return_t internal_io_service_add_notification(
     do {
         err = kIOReturnNoResources;
 
     do {
         err = kIOReturnNoResources;
 

+        if (matching_size > (sizeof(io_struct_inband_t) * 1024)) return(kIOReturnMessageTooLarge);
+

         if( !(sym = OSSymbol::withCString( notification_type )))
            err = kIOReturnNoResources;
 
         if( !(sym = OSSymbol::withCString( notification_type )))
            err = kIOReturnNoResources;
 


@@ -2327,7 +2338,8 @@ static kern_return_t internal_io_service_add_notification(
        else if( (sym == gIOMatchedNotification)
              || (sym == gIOFirstMatchNotification))
            userMsgType = kIOServiceMatchedNotificationType;
        else if( (sym == gIOMatchedNotification)
              || (sym == gIOFirstMatchNotification))
            userMsgType = kIOServiceMatchedNotificationType;

-       else if( sym == gIOTerminatedNotification)
+       else if ((sym == gIOTerminatedNotification)
+             || (sym == gIOWillTerminateNotification))

            userMsgType = kIOServiceTerminatedNotificationType;
        else
            userMsgType = kLastIOKitNotificationType;
            userMsgType = kIOServiceTerminatedNotificationType;
        else
            userMsgType = kLastIOKitNotificationType;


@@ -2336,7 +2348,6 @@ static kern_return_t internal_io_service_add_notification(
 
         if( userNotify && !userNotify->init( port, userMsgType,
                                              reference, referenceSize, client64)) {
 
         if( userNotify && !userNotify->init( port, userMsgType,
                                              reference, referenceSize, client64)) {

-                       iokit_release_port_send(port);

             userNotify->release();
             userNotify = 0;
         }
             userNotify->release();
             userNotify = 0;
         }


@@ -2354,6 +2365,13 @@ static kern_return_t internal_io_service_add_notification(
 
     } while( false );
 
 
     } while( false );
 

+    if ((kIOReturnSuccess != err) && userNotify)
+    {
+       userNotify->invalidatePort();
+       userNotify->release();
+       userNotify = 0;
+    }
+

     if( sym)
        sym->release();
     if( dict)
     if( sym)
        sym->release();
     if( dict)


@@ -2529,7 +2547,6 @@ static kern_return_t internal_io_service_add_interest_notification(
                                              reference, referenceSize,
                                             kIOUserNotifyMaxMessageSize,
                                             client64 )) {
                                              reference, referenceSize,
                                             kIOUserNotifyMaxMessageSize,
                                             client64 )) {

-                       iokit_release_port_send(port);

             userNotify->release();
             userNotify = 0;
         }
             userNotify->release();
             userNotify = 0;
         }


@@ -2549,6 +2566,13 @@ static kern_return_t internal_io_service_add_interest_notification(
 
     } while( false );
 
 
     } while( false );
 

+    if ((kIOReturnSuccess != err) && userNotify)
+    {
+       userNotify->invalidatePort();
+       userNotify->release();
+       userNotify = 0;
+    }
+

     return( err );
 }
 
     return( err );
 }
 


@@ -2920,6 +2944,7 @@ kern_return_t is_io_registry_entry_get_property_bytes(
     if( (data = OSDynamicCast( OSData, obj ))) {
        len = data->getLength();
        bytes = data->getBytesNoCopy();
     if( (data = OSDynamicCast( OSData, obj ))) {
        len = data->getLength();
        bytes = data->getBytesNoCopy();

+       if (!data->isSerializable()) len = 0;

 
     } else if( (str = OSDynamicCast( OSString, obj ))) {
        len = str->getLength() + 1;
 
     } else if( (str = OSDynamicCast( OSString, obj ))) {
        len = str->getLength() + 1;


@@ -2932,6 +2957,7 @@ kern_return_t is_io_registry_entry_get_property_bytes(
     } else if( (off = OSDynamicCast( OSNumber, obj ))) {
        offsetBytes = off->unsigned64BitValue();
        len = off->numberOfBytes();
     } else if( (off = OSDynamicCast( OSNumber, obj ))) {
        offsetBytes = off->unsigned64BitValue();
        len = off->numberOfBytes();

+       if (len > sizeof(offsetBytes)) len = sizeof(offsetBytes);

        bytes = &offsetBytes;
 #ifdef __BIG_ENDIAN__
        bytes = (const void *)
        bytes = &offsetBytes;
 #ifdef __BIG_ENDIAN__
        bytes = (const void *)


@@ -3383,7 +3409,8 @@ kern_return_t is_io_service_open_extended(
 
     do
     {
 
     do
     {

-       if (properties)
+       if (properties) return (kIOReturnUnsupported);
+#if 0

        {
            OSObject *      obj;
            vm_offset_t     data;
        {
            OSObject *      obj;
            vm_offset_t     data;


@@ -3411,7 +3438,7 @@ kern_return_t is_io_service_open_extended(
            if (kIOReturnSuccess != res)
                break;
        }
            if (kIOReturnSuccess != res)
                break;
        }

-
+#endif

        crossEndian = (ndr.int_rep != NDR_record.int_rep);
        if (crossEndian)
        {
        crossEndian = (ndr.int_rep != NDR_record.int_rep);
        if (crossEndian)
        {


@@ -3663,7 +3690,7 @@ kern_return_t is_io_connect_unmap_memory_from_task
 {
     IOReturn           err;
     IOOptionBits       options = 0;
 {
     IOReturn           err;
     IOOptionBits       options = 0;

-    IOMemoryDescriptor * memory;
+    IOMemoryDescriptor * memory = 0;

     IOMemoryMap *      map;
 
     CHECK( IOUserClient, connection, client );
     IOMemoryMap *      map;
 
     CHECK( IOUserClient, connection, client );


@@ -3790,9 +3817,12 @@ kern_return_t is_io_connect_method_var_output
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 

+    if (ool_input && (ool_input_size <= sizeof(io_struct_inband_t)))    return (kIOReturnIPCError);
+

     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size, 
     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size, 

-                                                   kIODirectionOut, current_task());
+                                                   kIODirectionOut | kIOMemoryMapCopyOnWrite,
+                                                   current_task());

 
     args.structureInputDescriptor = inputMD;
 
 
     args.structureInputDescriptor = inputMD;
 


@@ -3884,9 +3914,13 @@ kern_return_t is_io_connect_method
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 

+    if (ool_input && (ool_input_size <= sizeof(io_struct_inband_t)))    return (kIOReturnIPCError);
+    if (ool_output && (*ool_output_size <= sizeof(io_struct_inband_t))) return (kIOReturnIPCError);
+

     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size, 
     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size, 

-                                                   kIODirectionOut, current_task());
+                                                   kIODirectionOut | kIOMemoryMapCopyOnWrite,
+                                                   current_task());

 
     args.structureInputDescriptor = inputMD;
 
 
     args.structureInputDescriptor = inputMD;
 


@@ -3963,14 +3997,20 @@ kern_return_t is_io_connect_async_method
     args.asyncReference      = reference;
     args.asyncReferenceCount = referenceCnt;
 
     args.asyncReference      = reference;
     args.asyncReferenceCount = referenceCnt;
 

+    args.structureVariableOutputData = 0;
+

     args.scalarInput = scalar_input;
     args.scalarInputCount = scalar_inputCnt;
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 
     args.scalarInput = scalar_input;
     args.scalarInputCount = scalar_inputCnt;
     args.structureInput = inband_input;
     args.structureInputSize = inband_inputCnt;
 

+    if (ool_input && (ool_input_size <= sizeof(io_struct_inband_t)))    return (kIOReturnIPCError);
+    if (ool_output && (*ool_output_size <= sizeof(io_struct_inband_t))) return (kIOReturnIPCError);
+

     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size,
     if (ool_input)
        inputMD = IOMemoryDescriptor::withAddressRange(ool_input, ool_input_size,

-                                                   kIODirectionOut, current_task());
+                                                   kIODirectionOut | kIOMemoryMapCopyOnWrite,
+                                                   current_task());

 
     args.structureInputDescriptor = inputMD;
 
 
     args.structureInputDescriptor = inputMD;
 


@@ -4856,6 +4896,9 @@ kern_return_t is_io_catalog_send_data(
         mach_msg_type_number_t         inDataCount,
         kern_return_t *                result)
 {
         mach_msg_type_number_t         inDataCount,
         kern_return_t *                result)
 {

+#if NO_KEXTD
+    return kIOReturnNotPrivileged;
+#else /* NO_KEXTD */

     OSObject * obj = 0;
     vm_offset_t data;
     kern_return_t kr = kIOReturnError;
     OSObject * obj = 0;
     vm_offset_t data;
     kern_return_t kr = kIOReturnError;


@@ -4873,6 +4916,16 @@ kern_return_t is_io_catalog_send_data(
         return kIOReturnBadArgument;
     }
 
         return kIOReturnBadArgument;
     }
 

+    if (!IOTaskHasEntitlement(current_task(), "com.apple.rootless.kext-management"))
+    {
+        OSString * taskName = IOCopyLogNameForPID(proc_selfpid());
+        IOLog("IOCatalogueSendData(%s): Not entitled\n", taskName ? taskName->getCStringNoCopy() : "");
+        OSSafeReleaseNULL(taskName);
+        // For now, fake success to not break applications relying on this function succeeding.
+        // See <rdar://problem/32554970> for more details.
+        return kIOReturnSuccess;
+    }
+

     if (inData) {
         vm_map_offset_t map_data;
 
     if (inData) {
         vm_map_offset_t map_data;
 


@@ -5002,9 +5055,10 @@ kern_return_t is_io_catalog_send_data(
     }
 
     if (obj) obj->release();
     }
 
     if (obj) obj->release();

-    
+

     *result = kr;
     return( KERN_SUCCESS);
     *result = kr;
     return( KERN_SUCCESS);

+#endif /* NO_KEXTD */

 }
 
 /* Routine io_catalog_terminate */
 }
 
 /* Routine io_catalog_terminate */


@@ -5091,7 +5145,7 @@ kern_return_t is_io_catalog_get_data(
         vm_size_t size;
 
         size = s->getLength();
         vm_size_t size;
 
         size = s->getLength();

-        kr = vm_allocate(kernel_map, &data, size, VM_FLAGS_ANYWHERE);
+        kr = vm_allocate_kernel(kernel_map, &data, size, VM_FLAGS_ANYWHERE, VM_KERN_MEMORY_IOKIT);

         if ( kr == kIOReturnSuccess ) {
             bcopy(s->text(), (void *)data, size);
             kr = vm_map_copyin(kernel_map, (vm_map_address_t)data,
         if ( kr == kIOReturnSuccess ) {
             bcopy(s->text(), (void *)data, size);
             kr = vm_map_copyin(kernel_map, (vm_map_address_t)data,