Changeset 23037

Timestamp:

02/07/07 10:26:57 (22 months ago)

Author:

zarzycki@…

Message:

<rdar://problem/4941920> job_export_all() crash via launchd's Unix IPC

Location:

trunk/launchd/src

Files:

• launchd_core_logic.c (modified) (7 diffs)
• launchd_core_logic.h (modified) (1 diff)

trunk/launchd/src/launchd_core_logic.c

@@ -977 +977 @@
         }
 
-        job_dispatch(j, false);
-
-        return j;
+        return job_dispatch(j, false);
 }
 
@@ -1642 +1640 @@
 jobmgr_dispatch_all(jobmgr_t jm)
 {
-        jobmgr_t jmi;
-        job_t ji;
-
-        SLIST_FOREACH(jmi, &jm->submgrs, sle) {
+        jobmgr_t jmi, jmn;
+        job_t ji, jn;
+
+        SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) {
                 jobmgr_dispatch_all(jmi);
         }
 
-        SLIST_FOREACH(ji, &jm->jobs, sle) {
+        SLIST_FOREACH_SAFE(ji, &jm->jobs, sle, jn) {
                 job_dispatch(ji, false);
         }
 }
 
-void
+job_t
 job_dispatch(job_t j, bool kickstart)
 {
@@ -1665 +1663 @@
          * This is a classic example. The act of dispatching a job may delete it.
          */
-        if (job_active(j)) {
-                return;
-        } else if (job_useless(j)) {
-                job_remove(j);
-        } else if (kickstart || job_keepalive(j)) {
-                job_start(j);
-        } else {
-                job_watch(j);
-        }
+        if (!job_active(j)) {
+                if (job_useless(j)) {
+                        job_remove(j);
+                        return NULL;
+                } else if (kickstart || job_keepalive(j)) {
+                        job_start(j);
+                } else {
+                        job_watch(j);
+                }
+        }
+
+        return j;
 }
 
@@ -3469 +3470 @@
         }
 
+        /* We don't need the _SAFE version because we return after the job_dispatch() */
         SLIST_FOREACH(ji, &jm->jobs, sle) {
                 SLIST_FOREACH(ms, &ji->machservices, sle) {
@@ -3614 +3616 @@
 jobmgr_dispatch_all_semaphores(jobmgr_t jm)
 {
-        jobmgr_t jmi;
+        jobmgr_t jmi, jmn;
         job_t ji, jn;
 
 
-        SLIST_FOREACH(jmi, &jm->submgrs, sle) {
+        SLIST_FOREACH_SAFE(jmi, &jm->submgrs, sle, jmn) {
                 jobmgr_dispatch_all_semaphores(jmi);
         }
@@ -3980 +3982 @@
                 ms->hide = true;
 
-                job_dispatch(ji, false);
-        }
-
-        *up_cont = machservice_port(SLIST_FIRST(&ji->machservices));
+                ji = job_dispatch(ji, false);
+        }
+
+        if (job_assumes(j, ji != NULL)) {
+                *up_cont = machservice_port(SLIST_FIRST(&ji->machservices));
+        }
 
         return 0;
@@ -4539 +4543 @@
         jr->j_binpref_cnt = binpref_cnt;
 
-        job_dispatch(jr, true);
+        jr = job_dispatch(jr, true);
+
+        if (!job_assumes(j, jr != NULL)) {
+                return BOOTSTRAP_NO_MEMORY;
+        }
 
         if (!job_setup_machport(jr)) {

trunk/launchd/src/launchd_core_logic.h

@@ -44 +44 @@
 
 job_t job_new(jobmgr_t jm, const char *label, const char *prog, const char *const *argv, const char *stdinpath);
-void job_dispatch(job_t j, bool kickstart);
+job_t job_dispatch(job_t j, bool kickstart); /* returns j on success, NULL on job removal */
 bool job_active(job_t j);
 launch_data_t job_export(job_t j);