source: mainline/kernel/generic/src/ipc/kbox.c@ f8b69a1e

Last change on this file since f8b69a1e was 07d4271, checked in by Jiří Zárevúcky <zarevucky.jiri@…>, 17 months ago

Fix some unsound task reference manipulation and locking

In some operations that take task ID as an argument,
there's a possibility of the task being destroyed mid-operation
and a subsequent use-after-free situation.
As a general solution, task_find_by_id() is reimplemented to
check for this situation and always return a valid strong reference.
The callers then only need to handle the reference itself, and
don't need to concern themselves with tasks_lock.

  • Property mode set to 100644
File size: 6.8 KB
Line 
1/*
2 * Copyright (c) 2008 Jiri Svoboda
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * - Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * - Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * - The name of the author may not be used to endorse or promote products
15 * derived from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29/** @addtogroup kernel_generic_ipc
30 * @{
31 */
32/** @file
33 */
34
35#include <synch/spinlock.h>
36#include <synch/mutex.h>
37#include <ipc/ipc.h>
38#include <abi/ipc/methods.h>
39#include <ipc/ipcrsc.h>
40#include <arch.h>
41#include <errno.h>
42#include <debug.h>
43#include <udebug/udebug_ipc.h>
44#include <ipc/kbox.h>
45#include <proc/thread.h>
46
47void ipc_kbox_cleanup(void)
48{
49 /*
50 * Not really needed, just to be consistent with the meaning of
51 * answerbox_t.active.
52 */
53 irq_spinlock_lock(&TASK->kb.box.lock, true);
54 TASK->kb.box.active = false;
55 irq_spinlock_unlock(&TASK->kb.box.lock, true);
56
57 /*
58 * Only hold kb.cleanup_lock while setting kb.finished -
59 * this is enough.
60 */
61 mutex_lock(&TASK->kb.cleanup_lock);
62 TASK->kb.finished = true;
63 mutex_unlock(&TASK->kb.cleanup_lock);
64
65 bool have_kb_thread = (TASK->kb.thread != NULL);
66
67 /*
68 * From now on nobody will try to connect phones or attach
69 * kbox threads
70 */
71
72 /*
73 * Disconnect all phones connected to our kbox. Passing true for
74 * notify_box causes a HANGUP message to be inserted for each
75 * disconnected phone. This ensures the kbox thread is going to
76 * wake up and terminate.
77 */
78 ipc_answerbox_slam_phones(&TASK->kb.box, have_kb_thread);
79
80 /*
81 * If the task was being debugged, clean up debugging session.
82 * This is necessarry as slamming the phones won't force
83 * kbox thread to clean it up since sender != debugger.
84 */
85 mutex_lock(&TASK->udebug.lock);
86 udebug_task_cleanup(TASK);
87 mutex_unlock(&TASK->udebug.lock);
88
89 if (have_kb_thread) {
90 LOG("Join kb.thread.");
91 thread_join(TASK->kb.thread);
92 LOG("...join done.");
93 TASK->kb.thread = NULL;
94 }
95
96 /* Answer all messages in 'calls' and 'dispatched_calls' queues. */
97 ipc_cleanup_call_list(&TASK->kb.box, &TASK->kb.box.calls);
98 ipc_cleanup_call_list(&TASK->kb.box, &TASK->kb.box.dispatched_calls);
99}
100
101/** Handle hangup message in kbox.
102 *
103 * @param call The IPC_M_PHONE_HUNGUP call structure.
104 * @param last Output, the function stores @c true here if
105 * this was the last phone, @c false otherwise.
106 *
107 */
108static void kbox_proc_phone_hungup(call_t *call, bool *last)
109{
110 /* Was it our debugger, who hung up? */
111 if (call->sender == TASK->udebug.debugger) {
112 /* Terminate debugging session (if any). */
113 LOG("Terminate debugging session.");
114 mutex_lock(&TASK->udebug.lock);
115 udebug_task_cleanup(TASK);
116 mutex_unlock(&TASK->udebug.lock);
117 } else {
118 LOG("Was not debugger.");
119 }
120
121 LOG("Continue with hangup message.");
122 ipc_set_retval(&call->data, 0);
123 ipc_answer(&TASK->kb.box, call);
124
125 mutex_lock(&TASK->kb.cleanup_lock);
126
127 irq_spinlock_lock(&TASK->lock, true);
128 irq_spinlock_lock(&TASK->kb.box.lock, false);
129 if (list_empty(&TASK->kb.box.connected_phones)) {
130 /*
131 * Last phone has been disconnected. Detach this thread so it
132 * gets freed and signal to the caller.
133 */
134
135 /* Only detach kbox thread unless already terminating. */
136 if (TASK->kb.finished == false) {
137 /* Release kbox thread so it gets freed from memory. */
138 thread_put(TASK->kb.thread);
139 TASK->kb.thread = NULL;
140 }
141
142 LOG("Phone list is empty.");
143 *last = true;
144 } else
145 *last = false;
146
147 irq_spinlock_unlock(&TASK->kb.box.lock, false);
148 irq_spinlock_unlock(&TASK->lock, true);
149
150 mutex_unlock(&TASK->kb.cleanup_lock);
151}
152
153/** Implementing function for the kbox thread.
154 *
155 * This function listens for debug requests. It terminates
156 * when all phones are disconnected from the kbox.
157 *
158 * @param arg Ignored.
159 *
160 */
161static void kbox_thread_proc(void *arg)
162{
163 (void) arg;
164 LOG("Starting.");
165 bool done = false;
166
167 while (!done) {
168 call_t *call = NULL;
169 (void) ipc_wait_for_call(&TASK->kb.box, SYNCH_NO_TIMEOUT,
170 SYNCH_FLAGS_NONE, &call);
171
172 if (call == NULL)
173 continue; /* Try again. */
174
175 switch (ipc_get_imethod(&call->data)) {
176
177 case IPC_M_DEBUG:
178 /* Handle debug call. */
179 udebug_call_receive(call);
180 break;
181
182 case IPC_M_PHONE_HUNGUP:
183 /*
184 * Process the hangup call. If this was the last
185 * phone, done will be set to true and the
186 * while loop will terminate.
187 */
188 kbox_proc_phone_hungup(call, &done);
189 break;
190
191 default:
192 /* Ignore */
193 break;
194 }
195 }
196
197 LOG("Exiting.");
198}
199
200/** Connect phone to a task kernel-box specified by id.
201 *
202 * @param[out] out_phone Phone capability handle on success.
203 * @return Error code.
204 *
205 */
206errno_t ipc_connect_kbox(task_id_t taskid, cap_phone_handle_t *out_phone)
207{
208 task_t *task = task_find_by_id(taskid);
209 if (!task)
210 return ENOENT;
211
212 mutex_lock(&task->kb.cleanup_lock);
213
214 if (task->kb.finished) {
215 mutex_unlock(&task->kb.cleanup_lock);
216 task_release(task);
217 return EINVAL;
218 }
219
220 /* Create a kbox thread if necessary. */
221 if (task->kb.thread == NULL) {
222 thread_t *kb_thread = thread_create(kbox_thread_proc, NULL, task,
223 THREAD_FLAG_NONE, "kbox");
224
225 if (!kb_thread) {
226 mutex_unlock(&task->kb.cleanup_lock);
227 task_release(task);
228 return ENOMEM;
229 }
230
231 task->kb.thread = kb_thread;
232 thread_start(kb_thread);
233 }
234
235 /* Allocate a new phone. */
236 cap_phone_handle_t phone_handle;
237 errno_t rc = phone_alloc(TASK, true, &phone_handle, NULL);
238 if (rc != EOK) {
239 mutex_unlock(&task->kb.cleanup_lock);
240 task_release(task);
241 return rc;
242 }
243
244 kobject_t *phone_obj = kobject_get(TASK, phone_handle,
245 KOBJECT_TYPE_PHONE);
246 /* Connect the newly allocated phone to the kbox */
247 /* Hand over phone_obj's reference to ipc_phone_connect() */
248 (void) ipc_phone_connect(phone_obj->phone, &task->kb.box);
249
250 mutex_unlock(&task->kb.cleanup_lock);
251 task_release(task);
252 *out_phone = phone_handle;
253 return EOK;
254}
255
256/** @}
257 */
Note: See TracBrowser for help on using the repository browser.