Changeset 51100 in vbox for trunk

Timestamp:

Apr 17, 2014 5:50:33 PM (11 years ago)

Author:

vboxsync

Message:

SUPDrv-darwin.cpp: Fixed buggy g_apSessionHashTab search in VBoxDrvDarwinIOCtl that could lead to spurious EINVAL/VERR_INVALID_PARAMETER errors and worse.

File:

• trunk/src/VBox/HostDrivers/Support/darwin/SUPDrv-darwin.cpp (modified) (5 diffs)

trunk/src/VBox/HostDrivers/Support/darwin/SUPDrv-darwin.cpp

@@ -5 +5 @@
 
 /*
- * Copyright (C) 2006-2013 Oracle Corporation
+ * Copyright (C) 2006-2014 Oracle Corporation
  *
  * This file is part of VirtualBox Open Source Edition (OSE), as
@@ -455 +455 @@
 
     /*
+     * The process issuing the request must be the current process.
+     */
+    RTPROCESS Process = RTProcSelf();
+    if (Process != proc_pid(pProcess))
+        return EIO;
+
+    /*
      * Find the session created by org_virtualbox_SupDrvClient, fail
      * if no such session, and mark it as opened. We set the uid & gid
@@ -472 +479 @@
         RTGID           Gid = pCred->cr_rgid;
 #endif
-        RTPROCESS       Process = RTProcSelf();
         unsigned        iHash = SESSION_HASH(Process);
         RTSpinlockAcquire(g_Spinlock);
@@ -552 +558 @@
      */
     RTSpinlockAcquire(g_Spinlock);
+
     pSession = g_apSessionHashTab[iHash];
-    while (pSession && pSession->Process != Process && pSession->fUnrestricted == fUnrestricted && pSession->fOpened)
+    while (pSession && (pSession->Process != Process || pSession->fUnrestricted != fUnrestricted || !pSession->fOpened))
         pSession = pSession->pNextHash;
 
     if (RT_LIKELY(pSession))
         supdrvSessionRetain(pSession);
+
     RTSpinlockReleaseNoInts(g_Spinlock);
-    if (!pSession)
+    if (RT_UNLIKELY(!pSession))
     {
         OSDBGPRINT(("VBoxDrvDarwinIOCtl: WHAT?!? pSession == NULL! This must be a mistake... pid=%d iCmd=%#lx\n",
@@ -1411 +1419 @@
 
                 PSUPDRVSESSION pCur = g_apSessionHashTab[iHash];
-                if (pCur && pCur->Process != m_pSession->Process)
-                {
-                    do pCur = pCur->pNextHash;
-                    while (pCur && pCur->Process != m_pSession->Process);
-                }
+                while (pCur && pCur->Process != m_pSession->Process)
+                    pCur = pCur->pNextHash;
                 if (!pCur)
                 {