xnu-2050.18.24.tar.gz

[apple/xnu.git] / osfmk / ipc / mach_port.c

diff --git a/osfmk/ipc/mach_port.c b/osfmk/ipc/mach_port.c
index 28d0fbc87d2fdc10c0be4d93f9bfd9a538f9e048..a2d4f0d7aaf67652c792c6e9361efdfb831705b0 100644 (file)
--- a/osfmk/ipc/mach_port.c
+++ b/osfmk/ipc/mach_port.c
@@ -128,6 +128,9 @@ static mach_port_qos_t      qos_template;
  *     Routine:        mach_port_names_helper
  *     Purpose:
  *             A helper function for mach_port_names.
  *     Routine:        mach_port_names_helper
  *     Purpose:
  *             A helper function for mach_port_names.

+ *
+ *     Conditions:
+ *             Space containing entry is [at least] read-locked.

  */
 
 void
  */
 
 void


@@ -141,44 +144,51 @@ mach_port_names_helper(
 {
        ipc_entry_bits_t bits;
        ipc_port_request_index_t request;
 {
        ipc_entry_bits_t bits;
        ipc_port_request_index_t request;

-       mach_port_type_t type;
+       mach_port_type_t type = 0;

        ipc_entry_num_t actual;
        ipc_entry_num_t actual;

+       ipc_port_t port;

 
        bits = entry->ie_bits;
        request = entry->ie_request;
 
        bits = entry->ie_bits;
        request = entry->ie_request;

-       if (bits & MACH_PORT_TYPE_SEND_RIGHTS) {
-               ipc_port_t port;
-               boolean_t died;
+       port = (ipc_port_t) entry->ie_object;

 
 

-               port = (ipc_port_t) entry->ie_object;
-               assert(port != IP_NULL);
+       if (bits & MACH_PORT_TYPE_RECEIVE) {
+               assert(IP_VALID(port));

 
 

-               /*
-                *      The timestamp serializes mach_port_names
-                *      with ipc_port_destroy.  If the port died,
-                *      but after mach_port_names started, pretend
-                *      that it isn't dead.
-                */
+               if (request != IE_REQ_NONE) {
+                       ip_lock(port);
+                       assert(ip_active(port));
+                       type |= ipc_port_request_type(port, name, request);
+                       ip_unlock(port);
+               }

 
 

-               ip_lock(port);
-               died = (!ip_active(port) &&
-                       IP_TIMESTAMP_ORDER(port->ip_timestamp, timestamp));
-               ip_unlock(port);
+       } else if (bits & MACH_PORT_TYPE_SEND_RIGHTS) {
+               mach_port_type_t reqtype;

 
 

-               if (died) {
-                       /* pretend this is a dead-name entry */
+               assert(IP_VALID(port));
+               ip_lock(port);

 
 

+               reqtype = (request != IE_REQ_NONE) ?
+                         ipc_port_request_type(port, name, request) : 0;
+               
+               /*
+                * If the port is alive, or was alive when the mach_port_names
+                * started, then return that fact.  Otherwise, pretend we found
+                * a dead name entry.
+                */
+               if (ip_active(port) || IP_TIMESTAMP_ORDER(timestamp, port->ip_timestamp)) {
+                       type |= reqtype;
+               } else {

                        bits &= ~(IE_BITS_TYPE_MASK);
                        bits |= MACH_PORT_TYPE_DEAD_NAME;
                        bits &= ~(IE_BITS_TYPE_MASK);
                        bits |= MACH_PORT_TYPE_DEAD_NAME;

-                       if (request != 0)
+                       /* account for additional reference for dead-name notification */
+                       if (reqtype != 0)

                                bits++;
                                bits++;

-                       request = 0;

                }
                }

+               ip_unlock(port);

        }
 
        }
 

-       type = IE_BITS_TYPE(bits);
-       if (request != 0)
-               type |= MACH_PORT_TYPE_DNREQUEST;
+       type |= IE_BITS_TYPE(bits);

 
        actual = *actualp;
        names[actual] = name;
 
        actual = *actualp;
        names[actual] = name;


@@ -211,7 +221,6 @@ mach_port_names(
        mach_port_type_t        **typesp,
        mach_msg_type_number_t  *typesCnt)
 {
        mach_port_type_t        **typesp,
        mach_msg_type_number_t  *typesCnt)
 {

-       ipc_tree_entry_t tentry;

        ipc_entry_t table;
        ipc_entry_num_t tsize;
        mach_port_index_t index;
        ipc_entry_t table;
        ipc_entry_num_t tsize;
        mach_port_index_t index;


@@ -240,7 +249,7 @@ mach_port_names(
                vm_size_t size_needed;
 
                is_read_lock(space);
                vm_size_t size_needed;
 
                is_read_lock(space);

-               if (!space->is_active) {
+               if (!is_active(space)) {

                        is_read_unlock(space);
                        if (size != 0) {
                                kmem_free(ipc_kernel_map, addr1, size);
                        is_read_unlock(space);
                        if (size != 0) {
                                kmem_free(ipc_kernel_map, addr1, size);


@@ -250,8 +259,7 @@ mach_port_names(
                }
 
                /* upper bound on number of names in the space */
                }
 
                /* upper bound on number of names in the space */

-
-               bound = space->is_table_size + space->is_tree_total;
+               bound = space->is_table_size;

                size_needed = round_page(bound * sizeof(mach_port_name_t));
 
                if (size_needed <= size)
                size_needed = round_page(bound * sizeof(mach_port_name_t));
 
                if (size_needed <= size)


@@ -320,17 +328,6 @@ mach_port_names(
                }
        }
 
                }
        }
 

-       for (tentry = ipc_splay_traverse_start(&space->is_tree);
-           tentry != ITE_NULL;
-           tentry = ipc_splay_traverse_next(&space->is_tree, FALSE)) {
-               ipc_entry_t entry = &tentry->ite_entry;
-               mach_port_name_t name = tentry->ite_name;
-
-               assert(IE_BITS_TYPE(tentry->ite_bits) != MACH_PORT_TYPE_NONE);
-               mach_port_names_helper(timestamp, entry, name, names,
-                                      types, &actual);
-       }
-       ipc_splay_traverse_finish(&space->is_tree);

        is_read_unlock(space);
 
        if (actual == 0) {
        is_read_unlock(space);
 
        if (actual == 0) {


@@ -431,12 +428,16 @@ mach_port_type(
        kr = ipc_right_lookup_write(space, name, &entry);
        if (kr != KERN_SUCCESS)
                return kr;
        kr = ipc_right_lookup_write(space, name, &entry);
        if (kr != KERN_SUCCESS)
                return kr;

-       /* space is write-locked and active */

 
 

+       /* space is write-locked and active */

        kr = ipc_right_info(space, name, entry, typep, &urefs);
        kr = ipc_right_info(space, name, entry, typep, &urefs);

-       if (kr == KERN_SUCCESS)
-               is_write_unlock(space);

        /* space is unlocked */
        /* space is unlocked */

+
+#if 1
+        /* JMM - workaround rdar://problem/9121297 (CF being too picky on these bits). */
+        *typep &= ~(MACH_PORT_TYPE_SPREQUEST | MACH_PORT_TYPE_SPREQUEST_DELAYED);
+#endif
+

        return kr;
 }
 
        return kr;
 }
 


@@ -455,26 +456,21 @@ mach_port_type(
  *             KERN_INVALID_VALUE      The nname isn't a legal name.
  *             KERN_NAME_EXISTS        The nname already denotes a right.
  *             KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.
  *             KERN_INVALID_VALUE      The nname isn't a legal name.
  *             KERN_NAME_EXISTS        The nname already denotes a right.
  *             KERN_RESOURCE_SHORTAGE  Couldn't allocate memory.

+ *
+ *      This interface is obsolete and always returns
+ *      KERN_NOT_SUPPORTED.

  */
 
 kern_return_t
 mach_port_rename(
  */
 
 kern_return_t
 mach_port_rename(

-       ipc_space_t             space,
-       mach_port_name_t        oname,
-       mach_port_name_t        nname)
+       __unused ipc_space_t            space,
+       __unused mach_port_name_t       oname,
+       __unused mach_port_name_t       nname)

 {
 {

-       if (space == IS_NULL)
-               return KERN_INVALID_TASK;
-
-       if (!MACH_PORT_VALID(oname))
-               return KERN_INVALID_NAME;
-
-       if (!MACH_PORT_VALID(nname))
-               return KERN_INVALID_VALUE;
-
-       return ipc_object_rename(space, oname, nname);
+       return KERN_NOT_SUPPORTED;

 }
 
 }
 

+

 /*
  *     Routine:        mach_port_allocate_name [kernel call]
  *     Purpose:
 /*
  *     Routine:        mach_port_allocate_name [kernel call]
  *     Purpose:


@@ -635,8 +631,6 @@ mach_port_allocate_full(
        if (qosp->name) {
                if (!MACH_PORT_VALID (*namep))
                        return (KERN_INVALID_VALUE);
        if (qosp->name) {
                if (!MACH_PORT_VALID (*namep))
                        return (KERN_INVALID_VALUE);

-               if (is_fast_space (space))
-                       return (KERN_FAILURE);

        }
 
        if (qosp->prealloc) {
        }
 
        if (qosp->prealloc) {


@@ -644,9 +638,11 @@ mach_port_allocate_full(
                        return KERN_RESOURCE_SHORTAGE;
                } else {
                        mach_msg_size_t size = qosp->len + MAX_TRAILER_SIZE;
                        return KERN_RESOURCE_SHORTAGE;
                } else {
                        mach_msg_size_t size = qosp->len + MAX_TRAILER_SIZE;

+

                        if (right != MACH_PORT_RIGHT_RECEIVE)
                                return (KERN_INVALID_VALUE);
                        if (right != MACH_PORT_RIGHT_RECEIVE)
                                return (KERN_INVALID_VALUE);

-                       kmsg = (ipc_kmsg_t)ipc_kmsg_alloc(size);
+
+                       kmsg = (ipc_kmsg_t)ipc_kmsg_prealloc(size);

                        if (kmsg == IKM_NULL)
                                return (KERN_RESOURCE_SHORTAGE);
                }
                        if (kmsg == IKM_NULL)
                                return (KERN_RESOURCE_SHORTAGE);
                }


@@ -733,8 +729,7 @@ mach_port_destroy(
                return kr;
        /* space is write-locked and active */
 
                return kr;
        /* space is write-locked and active */
 

-       kr = ipc_right_destroy(space, name, entry); 
-       is_write_unlock(space);
+       kr = ipc_right_destroy(space, name, entry); /* unlocks space */

        return kr;
 }
 
        return kr;
 }
 


@@ -826,12 +821,13 @@ mach_port_get_refs(
        kr = ipc_right_lookup_write(space, name, &entry);
        if (kr != KERN_SUCCESS)
                return kr;
        kr = ipc_right_lookup_write(space, name, &entry);
        if (kr != KERN_SUCCESS)
                return kr;

+

        /* space is write-locked and active */
        /* space is write-locked and active */

+       kr = ipc_right_info(space, name, entry, &type, &urefs);
+       /* space is unlocked */

 
 

-       kr = ipc_right_info(space, name, entry, &type, &urefs); /* unlocks */

        if (kr != KERN_SUCCESS)
        if (kr != KERN_SUCCESS)

-               return kr;      /* space is unlocked */
-       is_write_unlock(space);
+               return kr;      

 
        if (type & MACH_PORT_TYPE(right))
                switch (right) {
 
        if (type & MACH_PORT_TYPE(right))
                switch (right) {


@@ -1010,7 +1006,7 @@ kern_return_t
 mach_port_get_context(
        ipc_space_t             space,
        mach_port_name_t        name,
 mach_port_get_context(
        ipc_space_t             space,
        mach_port_name_t        name,

-       mach_vm_address_t       *context)
+       mach_vm_address_t       *context)

 {
        ipc_port_t port;
        kern_return_t kr;
 {
        ipc_port_t port;
        kern_return_t kr;


@@ -1051,7 +1047,7 @@ kern_return_t
 mach_port_set_context(
        ipc_space_t             space,
        mach_port_name_t        name,
 mach_port_set_context(
        ipc_space_t             space,
        mach_port_name_t        name,

-       mach_vm_address_t       context)
+       mach_vm_address_t       context)

 {
        ipc_port_t port;
        kern_return_t kr;
 {
        ipc_port_t port;
        kern_return_t kr;


@@ -1076,6 +1072,9 @@ mach_port_set_context(
 
 /*
  *     Routine:        mach_port_gst_helper
 
 /*
  *     Routine:        mach_port_gst_helper

+ *     Conditions:
+ *             portspace is locked for both the recieve right and pset
+ *             under observation.

  *     Purpose:
  *             A helper function for mach_port_get_set_status.
  */
  *     Purpose:
  *             A helper function for mach_port_get_set_status.
  */


@@ -1091,15 +1090,14 @@ mach_port_gst_helper(
        mach_port_name_t name;
 
        assert(port != IP_NULL);
        mach_port_name_t name;
 
        assert(port != IP_NULL);

-
-       ip_lock(port);
+       /*
+        * The space lock is held by the calling function,
+        * hence it is OK to read name without the port lock.
+        */

        assert(ip_active(port));
        assert(ip_active(port));

-

        name = port->ip_receiver_name;
        assert(name != MACH_PORT_NULL);
 
        name = port->ip_receiver_name;
        assert(name != MACH_PORT_NULL);
 

-       ip_unlock(port);
-

        if (ipc_pset_member(pset, port)) {
                ipc_entry_num_t actual = *actualp;
 
        if (ipc_pset_member(pset, port)) {
                ipc_entry_num_t actual = *actualp;
 


@@ -1150,7 +1148,6 @@ mach_port_get_set_status(
        size = PAGE_SIZE;       /* initial guess */
 
        for (;;) {
        size = PAGE_SIZE;       /* initial guess */
 
        for (;;) {

-               ipc_tree_entry_t tentry;

                ipc_entry_t entry, table;
                ipc_entry_num_t tsize;
                mach_port_index_t index;
                ipc_entry_t entry, table;
                ipc_entry_num_t tsize;
                mach_port_index_t index;


@@ -1193,31 +1190,15 @@ mach_port_get_set_status(
 
                for (index = 0; index < tsize; index++) {
                        ipc_entry_t ientry = &table[index];
 
                for (index = 0; index < tsize; index++) {
                        ipc_entry_t ientry = &table[index];

+                       ipc_port_t port = (ipc_port_t) ientry->ie_object;

 
 

-                       if (ientry->ie_bits & MACH_PORT_TYPE_RECEIVE) {
-                               ipc_port_t port =
-                                       (ipc_port_t) ientry->ie_object;
-
+                       if (ientry->ie_bits & MACH_PORT_TYPE_RECEIVE &&
+                           port->ip_pset_count > 0) {

                                mach_port_gst_helper(pset, port,
                                                     maxnames, names, &actual);
                        }
                }
 
                                mach_port_gst_helper(pset, port,
                                                     maxnames, names, &actual);
                        }
                }
 

-               for (tentry = ipc_splay_traverse_start(&space->is_tree);
-                   tentry != ITE_NULL;
-                   tentry = ipc_splay_traverse_next(&space->is_tree,FALSE)) {
-                       ipc_entry_bits_t bits = tentry->ite_bits;
-
-                       assert(IE_BITS_TYPE(bits) != MACH_PORT_TYPE_NONE);
-
-                       if (bits & MACH_PORT_TYPE_RECEIVE) {
-                           ipc_port_t port = (ipc_port_t) tentry->ite_object;
-
-                           mach_port_gst_helper(pset, port, maxnames,
-                                                names, &actual);
-                       }
-               }
-               ipc_splay_traverse_finish(&space->is_tree);

                is_read_unlock(space);
 
                if (actual <= maxnames)
                is_read_unlock(space);
 
                if (actual <= maxnames)


@@ -1294,6 +1275,9 @@ mach_port_move_member(
        ipc_port_t port;
        ipc_pset_t nset;
        kern_return_t kr;
        ipc_port_t port;
        ipc_pset_t nset;
        kern_return_t kr;

+       wait_queue_link_t wql;
+       queue_head_t links_data;
+       queue_t links = &links_data;

 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;
 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;


@@ -1303,15 +1287,22 @@ mach_port_move_member(
 
        if (after == MACH_PORT_DEAD)
                return KERN_INVALID_RIGHT;
 
        if (after == MACH_PORT_DEAD)
                return KERN_INVALID_RIGHT;

+       else if (after == MACH_PORT_NULL)
+               wql = WAIT_QUEUE_LINK_NULL;
+       else
+               wql = wait_queue_link_allocate();
+
+       queue_init(links);

 
        kr = ipc_right_lookup_read(space, member, &entry);
        if (kr != KERN_SUCCESS)
 
        kr = ipc_right_lookup_read(space, member, &entry);
        if (kr != KERN_SUCCESS)

-               return kr;
+               goto done;

        /* space is read-locked and active */
 
        if ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0) {
                is_read_unlock(space);
        /* space is read-locked and active */
 
        if ((entry->ie_bits & MACH_PORT_TYPE_RECEIVE) == 0) {
                is_read_unlock(space);

-               return KERN_INVALID_RIGHT;
+               kr = KERN_INVALID_RIGHT;
+               goto done;

        }
 
        port = (ipc_port_t) entry->ie_object;
        }
 
        port = (ipc_port_t) entry->ie_object;


@@ -1323,27 +1314,38 @@ mach_port_move_member(
                entry = ipc_entry_lookup(space, after);
                if (entry == IE_NULL) {
                        is_read_unlock(space);
                entry = ipc_entry_lookup(space, after);
                if (entry == IE_NULL) {
                        is_read_unlock(space);

-                       return KERN_INVALID_NAME;
+                       kr = KERN_INVALID_NAME;
+                       goto done;

                }
 
                if ((entry->ie_bits & MACH_PORT_TYPE_PORT_SET) == 0) {
                        is_read_unlock(space);
                }
 
                if ((entry->ie_bits & MACH_PORT_TYPE_PORT_SET) == 0) {
                        is_read_unlock(space);

-                       return KERN_INVALID_RIGHT;
+                       kr = KERN_INVALID_RIGHT;
+                       goto done;

                }
 
                nset = (ipc_pset_t) entry->ie_object;
                assert(nset != IPS_NULL);
        }
        ip_lock(port);
                }
 
                nset = (ipc_pset_t) entry->ie_object;
                assert(nset != IPS_NULL);
        }
        ip_lock(port);

-       ipc_pset_remove_from_all(port);
+       ipc_pset_remove_from_all(port, links);

 
        if (nset != IPS_NULL) {
                ips_lock(nset);
 
        if (nset != IPS_NULL) {
                ips_lock(nset);

-               kr = ipc_pset_add(nset, port);
+               kr = ipc_pset_add(nset, port, wql);

                ips_unlock(nset);
        }
        ip_unlock(port);
        is_read_unlock(space);
                ips_unlock(nset);
        }
        ip_unlock(port);
        is_read_unlock(space);

+
+ done:
+       if (kr != KERN_SUCCESS && wql != WAIT_QUEUE_LINK_NULL)
+               wait_queue_link_free(wql);
+       while(!queue_empty(links)) {
+               wql = (wait_queue_link_t) dequeue(links);
+               wait_queue_link_free(wql);
+       }
+

        return kr;
 }
 
        return kr;
 }
 


@@ -1470,6 +1472,18 @@ mach_port_request_notification(
                break;
            }
 
                break;
            }
 

+           case MACH_NOTIFY_SEND_POSSIBLE:
+
+               if (!MACH_PORT_VALID(name)) {
+                       return KERN_INVALID_ARGUMENT;
+               }
+
+               kr = ipc_right_request_alloc(space, name, sync != 0,
+                                            TRUE, notify, previousp);
+               if (kr != KERN_SUCCESS)
+                       return kr;
+               break;
+

            case MACH_NOTIFY_DEAD_NAME:
 
                if (!MACH_PORT_VALID(name)) {
            case MACH_NOTIFY_DEAD_NAME:
 
                if (!MACH_PORT_VALID(name)) {


@@ -1481,8 +1495,8 @@ mach_port_request_notification(
                        return KERN_INVALID_ARGUMENT;
                }
 
                        return KERN_INVALID_ARGUMENT;
                }
 

-               kr = ipc_right_dnrequest(space, name, sync != 0,
-                                        notify, previousp);
+               kr = ipc_right_request_alloc(space, name, sync != 0,
+                                            FALSE, notify, previousp);

                if (kr != KERN_SUCCESS)
                        return kr;
                break;
                if (kr != KERN_SUCCESS)
                        return kr;
                break;


@@ -1675,7 +1689,7 @@ mach_port_get_attributes(
                         return kr;
                 /* port is locked and active */
                
                         return kr;
                 /* port is locked and active */
                

-               table = port->ip_dnrequests;
+               table = port->ip_requests;

                if (table == IPR_NULL)
                        *(int *)info = 0;
                else
                if (table == IPR_NULL)
                        *(int *)info = 0;
                else


@@ -1742,7 +1756,7 @@ mach_port_set_attributes(
                         return kr;
                 /* port is locked and active */
                
                         return kr;
                 /* port is locked and active */
                

-               kr = ipc_port_dngrow(port, *(int *)info);
+               kr = ipc_port_request_grow(port, *(int *)info);

                if (kr != KERN_SUCCESS)
                        return kr;
                break;
                if (kr != KERN_SUCCESS)
                        return kr;
                break;


@@ -1782,6 +1796,7 @@ mach_port_insert_member(
        ipc_object_t obj;
        ipc_object_t psobj;
        kern_return_t kr;
        ipc_object_t obj;
        ipc_object_t psobj;
        kern_return_t kr;

+       wait_queue_link_t wql;

 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;
 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;


@@ -1789,19 +1804,26 @@ mach_port_insert_member(
        if (!MACH_PORT_VALID(name) || !MACH_PORT_VALID(psname))
                return KERN_INVALID_RIGHT;
 
        if (!MACH_PORT_VALID(name) || !MACH_PORT_VALID(psname))
                return KERN_INVALID_RIGHT;
 

+       wql = wait_queue_link_allocate();
+

        kr = ipc_object_translate_two(space, 
                                      name, MACH_PORT_RIGHT_RECEIVE, &obj,
                                      psname, MACH_PORT_RIGHT_PORT_SET, &psobj);
        if (kr != KERN_SUCCESS)
        kr = ipc_object_translate_two(space, 
                                      name, MACH_PORT_RIGHT_RECEIVE, &obj,
                                      psname, MACH_PORT_RIGHT_PORT_SET, &psobj);
        if (kr != KERN_SUCCESS)

-               return kr;
+               goto done;

 
        /* obj and psobj are locked (and were locked in that order) */
        assert(psobj != IO_NULL);
        assert(obj != IO_NULL);
 
 
        /* obj and psobj are locked (and were locked in that order) */
        assert(psobj != IO_NULL);
        assert(obj != IO_NULL);
 

-       kr = ipc_pset_add((ipc_pset_t)psobj, (ipc_port_t)obj);
+       kr = ipc_pset_add((ipc_pset_t)psobj, (ipc_port_t)obj, wql);

        io_unlock(psobj);
        io_unlock(obj);
        io_unlock(psobj);
        io_unlock(obj);

+
+ done:
+       if (kr != KERN_SUCCESS)
+               wait_queue_link_free(wql);
+

        return kr;
 }
 
        return kr;
 }
 


@@ -1832,6 +1854,7 @@ mach_port_extract_member(
        ipc_object_t psobj;
        ipc_object_t obj;
        kern_return_t kr;
        ipc_object_t psobj;
        ipc_object_t obj;
        kern_return_t kr;

+       wait_queue_link_t wql = WAIT_QUEUE_LINK_NULL;

 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;
 
        if (space == IS_NULL)
                return KERN_INVALID_TASK;


@@ -1849,9 +1872,13 @@ mach_port_extract_member(
        assert(psobj != IO_NULL);
        assert(obj != IO_NULL);
 
        assert(psobj != IO_NULL);
        assert(obj != IO_NULL);
 

-       kr = ipc_pset_remove((ipc_pset_t)psobj, (ipc_port_t)obj);
+       kr = ipc_pset_remove((ipc_pset_t)psobj, (ipc_port_t)obj, &wql);

        io_unlock(psobj);
        io_unlock(obj);
        io_unlock(psobj);
        io_unlock(obj);

+
+       if (wql != WAIT_QUEUE_LINK_NULL)
+               wait_queue_link_free(wql);
+

        return kr;
 }
 
        return kr;
 }
 


@@ -1868,6 +1895,12 @@ task_set_port_space(
        kern_return_t kr;
        
        is_write_lock(space);
        kern_return_t kr;
        
        is_write_lock(space);

+
+       if (!is_active(space)) {
+               is_write_unlock(space);
+               return KERN_INVALID_TASK;
+       }
+

        kr = ipc_entry_grow_table(space, table_entries);
        if (kr == KERN_SUCCESS)
                is_write_unlock(space);
        kr = ipc_entry_grow_table(space, table_entries);
        if (kr == KERN_SUCCESS)
                is_write_unlock(space);


@@ -1902,6 +1935,7 @@ mach_get_label(
        dead = ipc_right_check(space, port, name, entry);
        if (dead) {
                is_write_unlock(space);
        dead = ipc_right_check(space, port, name, entry);
        if (dead) {
                is_write_unlock(space);

+               ip_release(port);

                return KERN_INVALID_RIGHT;
        }
        /* port is now locked */
                return KERN_INVALID_RIGHT;
        }
        /* port is now locked */


@@ -1945,6 +1979,7 @@ mach_get_label_text(
        labelstr_t              outlabel)
 {
        ipc_entry_t entry;
        labelstr_t              outlabel)
 {
        ipc_entry_t entry;

+       ipc_port_t port;

        kern_return_t kr;
        struct label *l;
        int dead;
        kern_return_t kr;
        struct label *l;
        int dead;


@@ -1959,10 +1994,11 @@ mach_get_label_text(
        if (kr != KERN_SUCCESS)
                return kr;
 
        if (kr != KERN_SUCCESS)
                return kr;
 

-       dead = ipc_right_check(space, (ipc_port_t) entry->ie_object, name,
-           entry);
+       port = (ipc_port_t)entry->ie_object;
+       dead = ipc_right_check(space, port, name, entry);

        if (dead) {
                is_write_unlock(space);
        if (dead) {
                is_write_unlock(space);

+               ip_release(port);

                return KERN_INVALID_RIGHT;
        }
        /* object (port) is now locked */
                return KERN_INVALID_RIGHT;
        }
        /* object (port) is now locked */