X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/316670eb35587141e969394ae8537d66b9211e80..c7d2c2c6ee645e10cbccdd01c6191873ec77239d:/iokit/Kernel/IODataQueue.cpp diff --git a/iokit/Kernel/IODataQueue.cpp b/iokit/Kernel/IODataQueue.cpp index 95988aaf4..e3afbdcf3 100644 --- a/iokit/Kernel/IODataQueue.cpp +++ b/iokit/Kernel/IODataQueue.cpp @@ -26,10 +26,22 @@ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ +#define DISABLE_DATAQUEUE_WARNING + #include + +#undef DISABLE_DATAQUEUE_WARNING + #include #include #include +#include + +struct IODataQueueInternal +{ + mach_msg_header_t msg; + UInt32 queueSize; +}; #ifdef enqueue #undef enqueue @@ -79,33 +91,62 @@ Boolean IODataQueue::initWithCapacity(UInt32 size) return false; } + if (size > UINT32_MAX - DATA_QUEUE_MEMORY_HEADER_SIZE) { + return false; + } + allocSize = round_page(size + DATA_QUEUE_MEMORY_HEADER_SIZE); if (allocSize < size) { return false; } + assert(!notifyMsg); + notifyMsg = IONew(IODataQueueInternal, 1); + if (!notifyMsg) { + return false; + } + bzero(notifyMsg, sizeof(IODataQueueInternal)); + ((IODataQueueInternal *)notifyMsg)->queueSize = size; + dataQueue = (IODataQueueMemory *)IOMallocAligned(allocSize, PAGE_SIZE); if (dataQueue == 0) { return false; } + bzero(dataQueue, allocSize); dataQueue->queueSize = size; - dataQueue->head = 0; - dataQueue->tail = 0; +// dataQueue->head = 0; +// dataQueue->tail = 0; return true; } Boolean IODataQueue::initWithEntries(UInt32 numEntries, UInt32 entrySize) { + // Checking overflow for (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE): + // check (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE) + if ((entrySize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) || + // check (numEntries + 1) + (numEntries > UINT32_MAX-1) || + // check (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE) + (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE > UINT32_MAX/(numEntries+1))) { + return false; + } + return (initWithCapacity((numEntries + 1) * (DATA_QUEUE_ENTRY_HEADER_SIZE + entrySize))); } void IODataQueue::free() { - if (dataQueue) { - IOFreeAligned(dataQueue, round_page(dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE)); + if (notifyMsg) { + if (dataQueue) { + IOFreeAligned(dataQueue, round_page(((IODataQueueInternal *)notifyMsg)->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE)); + dataQueue = NULL; + } + + IODelete(notifyMsg, IODataQueueInternal, 1); + notifyMsg = NULL; } super::free(); @@ -118,12 +159,25 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize) const UInt32 head = dataQueue->head; // volatile const UInt32 tail = dataQueue->tail; const UInt32 entrySize = dataSize + DATA_QUEUE_ENTRY_HEADER_SIZE; + UInt32 queueSize; IODataQueueEntry * entry; + // Check for overflow of entrySize + if (dataSize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) { + return false; + } + + // Check for underflow of (dataQueue->queueSize - tail) + queueSize = ((IODataQueueInternal *) notifyMsg)->queueSize; + if ((queueSize < tail) || (queueSize < head)) { + return false; + } + if ( tail >= head ) { // Is there enough room at the end for the entry? - if ( (tail + entrySize) <= dataQueue->queueSize ) + if ((entrySize <= UINT32_MAX - tail) && + ((tail + entrySize) <= queueSize) ) { entry = (IODataQueueEntry *)((UInt8 *)dataQueue->queue + tail); @@ -133,10 +187,10 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize) // The tail can be out of bound when the size of the new entry // exactly matches the available space at the end of the queue. // The tail can range from 0 to dataQueue->queueSize inclusive. - - dataQueue->tail += entrySize; + + OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail); } - else if ( head > entrySize ) // Is there enough room at the beginning? + else if ( head > entrySize ) // Is there enough room at the beginning? { // Wrap around to the beginning, but do not allow the tail to catch // up to the head. @@ -147,17 +201,17 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize) // doing this. The user client checks for this and will look for the size // at the beginning if there isn't room for it at the end. - if ( ( dataQueue->queueSize - tail ) >= DATA_QUEUE_ENTRY_HEADER_SIZE ) + if ( ( queueSize - tail ) >= DATA_QUEUE_ENTRY_HEADER_SIZE ) { ((IODataQueueEntry *)((UInt8 *)dataQueue->queue + tail))->size = dataSize; } memcpy(&dataQueue->queue->data, data, dataSize); - dataQueue->tail = entrySize; + OSCompareAndSwap(dataQueue->tail, entrySize, &dataQueue->tail); } else { - return false; // queue is full + return false; // queue is full } } else @@ -171,17 +225,17 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize) entry->size = dataSize; memcpy(&entry->data, data, dataSize); - dataQueue->tail += entrySize; + OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail); } else { - return false; // queue is full + return false; // queue is full } } // Send notification (via mach message) that data is available. - if ( ( head == tail ) /* queue was empty prior to enqueue() */ + if ( ( head == tail ) /* queue was empty prior to enqueue() */ || ( dataQueue->head == tail ) ) /* queue was emptied during enqueue() */ { sendDataAvailableNotification(); @@ -192,35 +246,27 @@ Boolean IODataQueue::enqueue(void * data, UInt32 dataSize) void IODataQueue::setNotificationPort(mach_port_t port) { - static struct _notifyMsg init_msg = { { - MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0), - sizeof (struct _notifyMsg), - MACH_PORT_NULL, - MACH_PORT_NULL, - 0, - 0 - } }; - - if (notifyMsg == 0) { - notifyMsg = IOMalloc(sizeof(struct _notifyMsg)); - } + mach_msg_header_t * msgh; - *((struct _notifyMsg *)notifyMsg) = init_msg; - - ((struct _notifyMsg *)notifyMsg)->h.msgh_remote_port = port; + msgh = &((IODataQueueInternal *) notifyMsg)->msg; + bzero(msgh, sizeof(mach_msg_header_t)); + msgh->msgh_bits = MACH_MSGH_BITS(MACH_MSG_TYPE_COPY_SEND, 0); + msgh->msgh_size = sizeof(mach_msg_header_t); + msgh->msgh_remote_port = port; } void IODataQueue::sendDataAvailableNotification() { - kern_return_t kr; - mach_msg_header_t * msgh; + kern_return_t kr; + mach_msg_header_t * msgh; - msgh = (mach_msg_header_t *)notifyMsg; - if (msgh && msgh->msgh_remote_port) { - kr = mach_msg_send_from_kernel_proper(msgh, msgh->msgh_size); + msgh = &((IODataQueueInternal *) notifyMsg)->msg; + if (msgh->msgh_remote_port) { + kr = mach_msg_send_from_kernel_with_options(msgh, msgh->msgh_size, MACH_SEND_TIMEOUT, MACH_MSG_TIMEOUT_NONE); switch(kr) { - case MACH_SEND_TIMED_OUT: // Notification already sent + case MACH_SEND_TIMED_OUT: // Notification already sent case MACH_MSG_SUCCESS: + case MACH_SEND_NO_BUFFER: break; default: IOLog("%s: dataAvailableNotification failed - msg_send returned: %d\n", /*getName()*/"IODataQueue", kr); @@ -232,11 +278,14 @@ void IODataQueue::sendDataAvailableNotification() IOMemoryDescriptor *IODataQueue::getMemoryDescriptor() { IOMemoryDescriptor *descriptor = 0; + UInt32 queueSize; + queueSize = ((IODataQueueInternal *) notifyMsg)->queueSize; if (dataQueue != 0) { - descriptor = IOMemoryDescriptor::withAddress(dataQueue, dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE, kIODirectionOutIn); + descriptor = IOMemoryDescriptor::withAddress(dataQueue, queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE, kIODirectionOutIn); } return descriptor; } +