1 /* 2 * Test that sending a message to a voucher with the same voucher as the voucher port 3 * with only one send right count with move send before the copy send doesn't panic. 4 * 5 * clang -o voucherentry voucherentry.c -ldarwintest -Weverything -Wno-gnu-flexible-array-initializer 6 * 7 * <rdar://problem/18826844> 8 */ 9 10 #include <mach/mach.h> 11 #include <darwintest.h> 12 13 T_GLOBAL_META( 14 T_META_NAMESPACE("xnu.ipc"), 15 T_META_RUN_CONCURRENTLY(TRUE), 16 T_META_RADAR_COMPONENT_NAME("xnu"), 17 T_META_RADAR_COMPONENT_VERSION("IPC")); 18 19 T_DECL(voucher_entry, "voucher_entry", T_META_CHECK_LEAKS(false), T_META_ALL_VALID_ARCHS(true), T_META_TAG_VM_PREFERRED) 20 { 21 kern_return_t kr = KERN_SUCCESS; 22 mach_voucher_t voucher = MACH_VOUCHER_NULL; 23 mach_port_name_t reply; 24 mach_port_options_t opts = { 25 .flags = MPO_REPLY_PORT, 26 }; 27 28 /* 29 * The bank voucher already exists in this process, so using it doesn't 30 * actually test the problem. Use an importance voucher instead. 31 */ 32 mach_voucher_attr_recipe_data_t recipe = { 33 .key = MACH_VOUCHER_ATTR_KEY_IMPORTANCE, 34 .command = MACH_VOUCHER_ATTR_IMPORTANCE_SELF, 35 .previous_voucher = MACH_VOUCHER_NULL, 36 .content_size = 0, 37 }; 38 39 kr = host_create_mach_voucher(mach_host_self(), 40 (mach_voucher_attr_raw_recipe_array_t)&recipe, 41 sizeof(recipe), &voucher); 42 43 T_ASSERT_MACH_SUCCESS(kr, "host_create_mach_voucher"); 44 45 T_ASSERT_NOTNULL(voucher, "voucher must not be null"); 46 47 mach_port_urefs_t refs = 0; 48 49 kr = mach_port_get_refs(mach_task_self(), voucher, MACH_PORT_RIGHT_SEND, &refs); 50 51 T_ASSERT_MACH_SUCCESS(kr, "mach_port_get_refs"); 52 53 T_ASSERT_EQ(refs, (mach_port_urefs_t)1, "voucher must have only one ref"); 54 55 T_ASSERT_MACH_SUCCESS(mach_port_construct(mach_task_self(), 56 &opts, 0, &reply), "make reply port"); 57 58 /* First, try with two moves (must fail because there's only one ref) */ 59 mach_msg_header_t request_msg_1 = { 60 .msgh_remote_port = voucher, 61 .msgh_local_port = reply, 62 .msgh_voucher_port = voucher, 63 .msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MOVE_SEND, 64 MACH_MSG_TYPE_MAKE_SEND_ONCE, MACH_MSG_TYPE_MOVE_SEND, 0), 65 .msgh_id = 0xDEAD, 66 .msgh_size = sizeof(request_msg_1), 67 }; 68 69 kr = mach_msg2(&request_msg_1, MACH64_SEND_MSG | MACH64_RCV_MSG | MACH64_SEND_KOBJECT_CALL, 70 request_msg_1, request_msg_1.msgh_size, 0, MACH_PORT_NULL, MACH_MSG_TIMEOUT_NONE, 0); 71 72 T_ASSERT_MACH_ERROR(MACH_SEND_INVALID_DEST, kr, "send with two moves should fail with invalid dest"); 73 74 T_ASSERT_MACH_SUCCESS(mach_port_destruct(mach_task_self(), reply, 0, 0), 75 "destroy reply port"); 76 77 T_ASSERT_MACH_SUCCESS(mach_port_construct(mach_task_self(), 78 &opts, 0, &reply), "make reply port"); 79 80 /* Next, try with a move and a copy (will succeed and destroy the last ref) */ 81 union { 82 mach_msg_header_t hdr; 83 struct { 84 mig_reply_error_t err; 85 mach_msg_trailer_t trailer; 86 }; 87 } request_msg_2 = { 88 .hdr = { 89 .msgh_remote_port = voucher, 90 .msgh_local_port = reply, 91 .msgh_voucher_port = voucher, 92 .msgh_bits = MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MOVE_SEND, 93 MACH_MSG_TYPE_MAKE_SEND_ONCE, MACH_MSG_TYPE_COPY_SEND, 0), 94 .msgh_id = 0xDEAD, 95 .msgh_size = sizeof(request_msg_2), 96 } 97 }; 98 99 /* panic happens here */ 100 kr = mach_msg2(&request_msg_2, MACH64_SEND_MSG | MACH64_RCV_MSG | MACH64_SEND_KOBJECT_CALL, 101 request_msg_2.hdr, request_msg_2.hdr.msgh_size, sizeof(request_msg_2), 102 reply, MACH_MSG_TIMEOUT_NONE, 0); 103 104 T_ASSERT_MACH_SUCCESS(kr, "send with move and copy succeeds"); 105 106 T_ASSERT_MACH_SUCCESS(mach_port_destruct(mach_task_self(), reply, 0, 0), 107 "destroy reply port"); 108 109 kr = mach_port_get_refs(mach_task_self(), voucher, MACH_PORT_RIGHT_SEND, &refs); 110 111 T_ASSERT_MACH_ERROR(KERN_INVALID_NAME, kr, "voucher should now be invalid name"); 112 } 113