source: mainline/kernel/generic/src/ipc/ops/conctmeto.c@ de1074b

lfn serial ticket/834-toolchain-update topic/msim-upgrade topic/simplify-dev-export
Last change on this file since de1074b was bde48fa, checked in by Jakub Jermar <jakub@…>, 8 years ago

Fix race condition

The capability created by phone_alloc() may get destroyed before
kobject_get(), so we must test kobject_get() return value.

  • Property mode set to 100644
File size: 3.7 KB
Line 
1/*
2 * Copyright (c) 2006 Ondrej Palkovsky
3 * Copyright (c) 2012 Jakub Jermar
4 * All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 *
10 * - Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * - Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * - The name of the author may not be used to endorse or promote products
16 * derived from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30/** @addtogroup genericipc
31 * @{
32 */
33/** @file
34 */
35
36#include <ipc/sysipc_ops.h>
37#include <ipc/ipc.h>
38#include <ipc/ipcrsc.h>
39#include <abi/errno.h>
40#include <arch.h>
41
42static errno_t request_preprocess(call_t *call, phone_t *phone)
43{
44 cap_handle_t phone_handle;
45 errno_t rc = phone_alloc(TASK, &phone_handle);
46
47 /* Remember the phone capability or that an error occured. */
48 call->priv = (rc == EOK) ? phone_handle : -1;
49
50 if (rc != EOK) {
51 return rc;
52 }
53
54 /* Set ARG5 for server */
55 kobject_t *phone_obj = kobject_get(TASK, phone_handle,
56 KOBJECT_TYPE_PHONE);
57 if (!phone_obj) {
58 /*
59 * Another thread of the same task can destroy the new
60 * capability before we manage to get a reference from it.
61 */
62 call->priv = -1;
63 return ENOENT;
64 }
65 /* Hand over phone_obj's reference to ARG5 */
66 IPC_SET_ARG5(call->data, (sysarg_t) phone_obj->phone);
67
68 return EOK;
69}
70
71static errno_t request_forget(call_t *call)
72{
73 cap_handle_t phone_handle = (cap_handle_t) call->priv;
74
75 if (phone_handle < 0) {
76 return EOK;
77 }
78
79 phone_dealloc(phone_handle);
80 /* Hand over reference from ARG5 to phone->kobject */
81 phone_t *phone = (phone_t *) IPC_GET_ARG5(call->data);
82 /* Drop phone_obj's reference */
83 kobject_put(phone->kobject);
84 return EOK;
85}
86
87static errno_t answer_preprocess(call_t *answer, ipc_data_t *olddata)
88{
89 /* Hand over reference from ARG5 to phone */
90 phone_t *phone = (phone_t *) IPC_GET_ARG5(*olddata);
91
92 /* If the user accepted call, connect */
93 if (IPC_GET_RETVAL(answer->data) == EOK) {
94 /* Hand over reference from phone to the answerbox */
95 (void) ipc_phone_connect(phone, &TASK->answerbox);
96 } else {
97 kobject_put(phone->kobject);
98 }
99
100 return EOK;
101}
102
103static errno_t answer_process(call_t *answer)
104{
105 cap_handle_t phone_handle = (cap_handle_t) answer->priv;
106
107 if (IPC_GET_RETVAL(answer->data)) {
108 if (phone_handle >= 0) {
109 /*
110 * The phone was indeed allocated and now needs
111 * to be deallocated.
112 */
113 phone_dealloc(phone_handle);
114 }
115 } else {
116 IPC_SET_ARG5(answer->data, phone_handle);
117 }
118
119 return EOK;
120}
121
122sysipc_ops_t ipc_m_connect_me_to_ops = {
123 .request_preprocess = request_preprocess,
124 .request_forget = request_forget,
125 .request_process = null_request_process,
126 .answer_cleanup = null_answer_cleanup,
127 .answer_preprocess = answer_preprocess,
128 .answer_process = answer_process,
129};
130
131/** @}
132 */
Note: See TracBrowser for help on using the repository browser.