Loading...
--- xnu/xnu-792/iokit/Kernel/IODataQueue.cpp
+++ xnu/xnu-2422.115.4/iokit/Kernel/IODataQueue.cpp
@@ -1,29 +1,36 @@
/*
* Copyright (c) 1998-2000 Apple Computer, Inc. All rights reserved.
*
- * @APPLE_LICENSE_HEADER_START@
- *
- * The contents of this file constitute Original Code as defined in and
- * are subject to the Apple Public Source License Version 1.1 (the
- * "License"). You may not use this file except in compliance with the
- * License. Please obtain a copy of the License at
- * http://www.apple.com/publicsource and read it before using this file.
- *
- * This Original Code and all software distributed under the License are
- * distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ *
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
* EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
* INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT. Please see the
- * License for the specific language governing rights and limitations
- * under the License.
- *
- * @APPLE_LICENSE_HEADER_END@
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
*/
#include <IOKit/IODataQueue.h>
#include <IOKit/IODataQueueShared.h>
#include <IOKit/IOLib.h>
#include <IOKit/IOMemoryDescriptor.h>
+#include <libkern/OSAtomic.h>
#ifdef enqueue
#undef enqueue
@@ -67,31 +74,53 @@
Boolean IODataQueue::initWithCapacity(UInt32 size)
{
+ vm_size_t allocSize = 0;
+
if (!super::init()) {
return false;
}
- dataQueue = (IODataQueueMemory *)IOMallocAligned(round_page_32(size + DATA_QUEUE_MEMORY_HEADER_SIZE), PAGE_SIZE);
+ if (size > UINT32_MAX - DATA_QUEUE_MEMORY_HEADER_SIZE) {
+ return false;
+ }
+
+ allocSize = round_page(size + DATA_QUEUE_MEMORY_HEADER_SIZE);
+
+ if (allocSize < size) {
+ return false;
+ }
+
+ dataQueue = (IODataQueueMemory *)IOMallocAligned(allocSize, PAGE_SIZE);
if (dataQueue == 0) {
return false;
}
- dataQueue->queueSize = size;
- dataQueue->head = 0;
- dataQueue->tail = 0;
+ dataQueue->queueSize = size;
+ dataQueue->head = 0;
+ dataQueue->tail = 0;
return true;
}
Boolean IODataQueue::initWithEntries(UInt32 numEntries, UInt32 entrySize)
{
+ // Checking overflow for (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE):
+ // check (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE)
+ if ((entrySize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) ||
+ // check (numEntries + 1)
+ (numEntries > UINT32_MAX-1) ||
+ // check (numEntries + 1)*(entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE)
+ (entrySize + DATA_QUEUE_ENTRY_HEADER_SIZE > UINT32_MAX/(numEntries+1))) {
+ return false;
+ }
+
return (initWithCapacity((numEntries + 1) * (DATA_QUEUE_ENTRY_HEADER_SIZE + entrySize)));
}
void IODataQueue::free()
{
if (dataQueue) {
- IOFreeAligned(dataQueue, round_page_32(dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE));
+ IOFreeAligned(dataQueue, round_page(dataQueue->queueSize + DATA_QUEUE_MEMORY_HEADER_SIZE));
}
super::free();
@@ -106,10 +135,20 @@
const UInt32 entrySize = dataSize + DATA_QUEUE_ENTRY_HEADER_SIZE;
IODataQueueEntry * entry;
+ // Check for overflow of entrySize
+ if (dataSize > UINT32_MAX - DATA_QUEUE_ENTRY_HEADER_SIZE) {
+ return false;
+ }
+ // Check for underflow of (dataQueue->queueSize - tail)
+ if (dataQueue->queueSize < tail) {
+ return false;
+ }
+
if ( tail >= head )
{
// Is there enough room at the end for the entry?
- if ( (tail + entrySize) <= dataQueue->queueSize )
+ if ((entrySize <= UINT32_MAX - tail) &&
+ ((tail + entrySize) <= dataQueue->queueSize) )
{
entry = (IODataQueueEntry *)((UInt8 *)dataQueue->queue + tail);
@@ -119,8 +158,8 @@
// The tail can be out of bound when the size of the new entry
// exactly matches the available space at the end of the queue.
// The tail can range from 0 to dataQueue->queueSize inclusive.
-
- dataQueue->tail += entrySize;
+
+ OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail);
}
else if ( head > entrySize ) // Is there enough room at the beginning?
{
@@ -139,7 +178,7 @@
}
memcpy(&dataQueue->queue->data, data, dataSize);
- dataQueue->tail = entrySize;
+ OSCompareAndSwap(dataQueue->tail, entrySize, &dataQueue->tail);
}
else
{
@@ -157,7 +196,7 @@
entry->size = dataSize;
memcpy(&entry->data, data, dataSize);
- dataQueue->tail += entrySize;
+ OSAddAtomic(entrySize, (SInt32 *)&dataQueue->tail);
}
else
{
@@ -202,11 +241,12 @@
mach_msg_header_t * msgh;
msgh = (mach_msg_header_t *)notifyMsg;
- if (msgh) {
- kr = mach_msg_send_from_kernel(msgh, msgh->msgh_size);
+ if (msgh && msgh->msgh_remote_port) {
+ kr = mach_msg_send_from_kernel_with_options(msgh, msgh->msgh_size, MACH_SEND_TIMEOUT, MACH_MSG_TIMEOUT_NONE);
switch(kr) {
case MACH_SEND_TIMED_OUT: // Notification already sent
case MACH_MSG_SUCCESS:
+ case MACH_SEND_NO_BUFFER:
break;
default:
IOLog("%s: dataAvailableNotification failed - msg_send returned: %d\n", /*getName()*/"IODataQueue", kr);