xnu-2782.20.48.tar.gz

[apple/xnu.git] / iokit / Kernel / IODataQueue.cpp

diff --git a/iokit/Kernel/IODataQueue.cpp b/iokit/Kernel/IODataQueue.cpp
index 263de30dc5132dfbab4ec242ca58e80f9f71ee88..79c97e1af1145073b5acdbfe01cdeb5eb94aed2c 100644 (file)
--- a/iokit/Kernel/IODataQueue.cpp
+++ b/iokit/Kernel/IODataQueue.cpp
@@ -26,10 +26,16 @@
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 
  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  */
 

+#define DISABLE_DATAQUEUE_WARNING
+

 #include <IOKit/IODataQueue.h>
 #include <IOKit/IODataQueue.h>

+
+#undef DISABLE_DATAQUEUE_WARNING
+

 #include <IOKit/IODataQueueShared.h>
 #include <IOKit/IOLib.h>
 #include <IOKit/IOMemoryDescriptor.h>
 #include <IOKit/IODataQueueShared.h>
 #include <IOKit/IOLib.h>
 #include <IOKit/IOMemoryDescriptor.h>

+#include <libkern/OSAtomic.h>

 
 #ifdef enqueue
 #undef enqueue
 
 #ifdef enqueue
 #undef enqueue


@@ -73,31 +79,67 @@ IODataQueue *IODataQueue::withEntries(UInt32 numEntries, UInt32 entrySize)
 
 Boolean IODataQueue::initWithCapacity(UInt32 size)
 {
 
 Boolean IODataQueue::initWithCapacity(UInt32 size)
 {

+    vm_size_t allocSize = 0;
+

     if (!super::init()) {
         return false;
     }
 
     if (!super::init()) {
         return false;
     }
 

-    dataQueue = (IODataQueueMemory *)IOMallocAligned(round_page_32(size + DATA_QUEUE_MEMORY_HEADER_SIZE), PAGE_SIZE);
+    if (size > UINT32_MAX - DATA_QUEUE_MEMORY_HEADER_SIZE) {
+        return false;
+    }
+    
+    allocSize = round_page(size + DATA_QUEUE_MEMORY_HEADER_SIZE);
+
+    if (allocSize < size) {
+        return false;
+    }
+
+    dataQueue = (IODataQueueMemory *)IOMallocAligned(allocSize, PAGE_SIZE);

     if (dataQueue == 0) {
         return false;
     }
     if (dataQueue == 0) {
         return false;
     }

+    bzero(dataQueue, allocSize);

 
 

-    dataQueue->queueSize = size;
-    dataQueue->head = 0;
-    dataQueue->tail = 0;
+    dataQueue->queueSize    = size;
+//  dataQueue->head         = 0;
+//  dataQueue->tail         = 0;
+
+    if (!notifyMsg) {
+        notifyMsg = IOMalloc(sizeof(mach_msg_header_t));
+        if (!notifyMsg)
+            return false;
+    }
+    bzero(notifyMsg, sizeof(mach_msg_header_t));

 
     return true;
 }
 
 Boolean IODataQueue::initWithEntries(UInt32 numEntries, UInt32 entrySize)
 {
 
     return true;
 }
 
 Boolean IODataQueue::initWithEntries(UInt32 numEntries, UInt32 entrySize)
 {

+    // Checking overflow for (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE):
+    //  check (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE)
+    if ((entrySize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) ||
+        //  check (numEntries + 1)
+        (numEntries > UINT32_MAX-1) ||
+        //  check (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE)
+        (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE > UINT32_MAX/(numEntries+1))) {
+        return false;
+    }
+    

     return (initWithCapacity((numEntries + 1) * (DATA_QUEUE_ENTRY_HEADER_SIZE + entrySize)));
 }
 
 void IODataQueue::free()
 {
     if (dataQueue) {
     return (initWithCapacity((numEntries + 1) * (DATA_QUEUE_ENTRY_HEADER_SIZE + entrySize)));
 }
 
 void IODataQueue::free()
 {
     if (dataQueue) {

-        IOFreeAligned(dataQueue, round_page_32(dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE));
+        IOFreeAligned(dataQueue, round_page(dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE));
+        dataQueue = NULL;
+
+        if (notifyMsg) {
+            IOFree(notifyMsg, sizeof(mach_msg_header_t));
+            notifyMsg = NULL;
+        }

     }
 
     super::free();
     }
 
     super::free();


@@ -112,10 +154,20 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize)
     const UInt32       entrySize = dataSize + DATA_QUEUE_ENTRY_HEADER_SIZE;
     IODataQueueEntry * entry;
 
     const UInt32       entrySize = dataSize + DATA_QUEUE_ENTRY_HEADER_SIZE;
     IODataQueueEntry * entry;
 

+    // Check for overflow of entrySize
+    if (dataSize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) {
+        return false;
+    }
+    // Check for underflow of (dataQueue->queueSize - tail)
+    if (dataQueue->queueSize < tail) {
+        return false;
+    }
+

     if ( tail >= head )
     {
         // Is there enough room at the end for the entry?
     if ( tail >= head )
     {
         // Is there enough room at the end for the entry?

-        if ( (tail + entrySize) <= dataQueue->queueSize )
+        if ((entrySize <= UINT32_MAX - tail) &&
+            ((tail + entrySize) <= dataQueue->queueSize) )

         {
             entry = (IODataQueueEntry *)((UInt8 *)dataQueue->queue + tail);
 
         {
             entry = (IODataQueueEntry *)((UInt8 *)dataQueue->queue + tail);
 


@@ -125,10 +177,10 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize)
             // The tail can be out of bound when the size of the new entry
             // exactly matches the available space at the end of the queue.
             // The tail can range from 0 to dataQueue->queueSize inclusive.
             // The tail can be out of bound when the size of the new entry
             // exactly matches the available space at the end of the queue.
             // The tail can range from 0 to dataQueue->queueSize inclusive.

-
-            dataQueue->tail += entrySize;
+            
+            OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail);

         }
         }

-        else if ( head > entrySize )   // Is there enough room at the beginning?
+        else if ( head > entrySize )     // Is there enough room at the beginning?

         {
             // Wrap around to the beginning, but do not allow the tail to catch
             // up to the head.
         {
             // Wrap around to the beginning, but do not allow the tail to catch
             // up to the head.


@@ -145,11 +197,11 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize)
             }
 
             memcpy(&dataQueue->queue->data, data, dataSize);
             }
 
             memcpy(&dataQueue->queue->data, data, dataSize);

-            dataQueue->tail = entrySize;
+            OSCompareAndSwap(dataQueue->tail, entrySize, &dataQueue->tail);

         }
         else
         {
         }
         else
         {

-            return false;      // queue is full
+            return false;    // queue is full

         }
     }
     else
         }
     }
     else


@@ -163,17 +215,17 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize)
 
             entry->size = dataSize;
             memcpy(&entry->data, data, dataSize);
 
             entry->size = dataSize;
             memcpy(&entry->data, data, dataSize);

-            dataQueue->tail += entrySize;
+            OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail);

         }
         else
         {
         }
         else
         {

-            return false;      // queue is full
+            return false;    // queue is full

         }
     }
 
     // Send notification (via mach message) that data is available.
 
         }
     }
 
     // Send notification (via mach message) that data is available.
 

-    if ( ( head == tail )                /* queue was empty prior to enqueue() */
+    if ( ( head == tail )                                                   /* queue was empty prior to enqueue() */

     ||   ( dataQueue->head == tail ) )   /* queue was emptied during enqueue() */
     {
         sendDataAvailableNotification();
     ||   ( dataQueue->head == tail ) )   /* queue was emptied during enqueue() */
     {
         sendDataAvailableNotification();


@@ -184,35 +236,28 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize)
 
 void IODataQueue::setNotificationPort(mach_port_t port)
 {
 
 void IODataQueue::setNotificationPort(mach_port_t port)
 {

-    static struct _notifyMsg init_msg = { {
-        MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0),
-        sizeof (struct _notifyMsg),
-        MACH_PORT_NULL,
-        MACH_PORT_NULL,
-        0,
-        0
-    } };
+    mach_msg_header_t * msgh = (mach_msg_header_t *) notifyMsg;

 
 

-    if (notifyMsg == 0) {
-        notifyMsg = IOMalloc(sizeof(struct _notifyMsg));
+    if (msgh) {
+        bzero(msgh, sizeof(mach_msg_header_t));
+        msgh->msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0);
+        msgh->msgh_size = sizeof(mach_msg_header_t);
+        msgh->msgh_remote_port = port;

     }
     }

-
-    *((struct _notifyMsg *)notifyMsg) = init_msg;
-
-    ((struct _notifyMsg *)notifyMsg)->h.msgh_remote_port = port;

 }
 
 void IODataQueue::sendDataAvailableNotification()
 {
 }
 
 void IODataQueue::sendDataAvailableNotification()
 {

-    kern_return_t              kr;
-    mach_msg_header_t *        msgh;
+    kern_return_t       kr;
+    mach_msg_header_t * msgh;

 
 

-    msgh = (mach_msg_header_t *)notifyMsg;
-    if (msgh) {
-        kr = mach_msg_send_from_kernel(msgh, msgh->msgh_size);
+    msgh = (mach_msg_header_t *) notifyMsg;
+    if (msgh && msgh->msgh_remote_port) {
+        kr = mach_msg_send_from_kernel_with_options(msgh, msgh->msgh_size, MACH_SEND_TIMEOUT, MACH_MSG_TIMEOUT_NONE);

         switch(kr) {
         switch(kr) {

-            case MACH_SEND_TIMED_OUT:  // Notification already sent
+            case MACH_SEND_TIMED_OUT:    // Notification already sent

             case MACH_MSG_SUCCESS:
             case MACH_MSG_SUCCESS:

+            case MACH_SEND_NO_BUFFER:

                 break;
             default:
                 IOLog("%s: dataAvailableNotification failed - msg_send returned: %d\n", /*getName()*/"IODataQueue", kr);
                 break;
             default:
                 IOLog("%s: dataAvailableNotification failed - msg_send returned: %d\n", /*getName()*/"IODataQueue", kr);


@@ -232,3 +277,4 @@ IOMemoryDescriptor *IODataQueue::getMemoryDescriptor()
     return descriptor;
 }
 
     return descriptor;
 }
 

+