xnu-517.tar.gz

[apple/xnu.git] / osfmk / ipc / ipc_object.c

diff --git a/osfmk/ipc/ipc_object.c b/osfmk/ipc/ipc_object.c
index df9081bef58c7c8f7408615c01121fc86eb6c3b1..a899d9bbb6d7a3ef944d126e446fd497024f6803 100644 (file)
--- a/osfmk/ipc/ipc_object.c
+++ b/osfmk/ipc/ipc_object.c
@@ -520,7 +520,8 @@ ipc_object_copyin(
  *             Copyin a naked capability from the kernel.
  *
  *             MACH_MSG_TYPE_MOVE_RECEIVE
- *                     The receiver must be ipc_space_kernel.
+ *                     The receiver must be ipc_space_kernel
+ *                     or the receive right must already be in limbo.
  *                     Consumes the naked receive right.
  *             MACH_MSG_TYPE_COPY_SEND
  *                     A naked send right must be supplied.
@@ -554,14 +555,15 @@ ipc_object_copyin_from_kernel(
 
                ip_lock(port);
                assert(ip_active(port));
-               assert(port->ip_receiver_name != MACH_PORT_NULL);
-               assert(port->ip_receiver == ipc_space_kernel);
+               if (port->ip_destination != IP_NULL) {
+                       assert(port->ip_receiver == ipc_space_kernel);
 
-               /* relevant part of ipc_port_clear_receiver */
-               ipc_port_set_mscount(port, 0);
+                       /* relevant part of ipc_port_clear_receiver */
+                       ipc_port_set_mscount(port, 0);
 
-               port->ip_receiver_name = MACH_PORT_NULL;
-               port->ip_destination = IP_NULL;
+                       port->ip_receiver_name = MACH_PORT_NULL;
+                       port->ip_destination = IP_NULL;
+               }
                ip_unlock(port);
                break;
            }
@@ -594,9 +596,12 @@ ipc_object_copyin_from_kernel(
                break;
            }
 
-           case MACH_MSG_TYPE_MOVE_SEND:
+           case MACH_MSG_TYPE_MOVE_SEND: {
                /* move naked send right into the message */
+               ipc_port_t port = (ipc_port_t) object;
+               assert(port->ip_srights);
                break;
+           }
 
            case MACH_MSG_TYPE_MAKE_SEND_ONCE: {
                ipc_port_t port = (ipc_port_t) object;
@@ -611,9 +616,12 @@ ipc_object_copyin_from_kernel(
                break;
            }
 
-           case MACH_MSG_TYPE_MOVE_SEND_ONCE:
+           case MACH_MSG_TYPE_MOVE_SEND_ONCE: {
                /* move naked send-once right into the message */
+               ipc_port_t port = (ipc_port_t) object;
+               assert(port->ip_sorights);
                break;
+           }
 
            default:
                panic("ipc_object_copyin_from_kernel: strange rights");