Open Radar

 
Summary:
In the function IOUserClient::setAsyncReference64 the OSAsyncReference64[kIOAsyncReservedIndex] is set as:

    asyncRef[kIOAsyncReservedIndex]  = ((io_user_reference_t)wakePort) | (kIOUCAsync0Flags & asyncRef[kIOAsyncReservedIndex]);

With a new OSAsyncReference64 asyncRef this reduces to:

    asyncRef[kIOAsyncReservedIndex]  = ((io_user_reference_t)wakePort);

This results in the kIOUCAsync64Flag not being set on asyncRef[kIOAsyncReservedIndex]. Later when IOUserClient::sendAsyncResult64 is called from a IOUserClient subclass, the mach_msg_header_t reply is performed as if it was a 32 bit callout. This results in the Userspace program crashing as as the callout function address is invalid.

Steps to Reproduce:
setAsyncReference64(m_ref, m_notification_port, arguments->asyncReference[kIOAsyncCalloutFuncIndex], arguments->asyncReference[kIOAsyncCalloutRefconIndex]);

Expected Results:
m_ref[kIOAsyncReservedIndex] & kIOUCAsync64Flag == kIOUCAsync64Flag

Actual Results:
m_ref[kIOAsyncReservedIndex] & kIOUCAsync64Flag == 0

Version:
xnu-2050.48.11

Notes:
To fix I do in my IOUserClient subclass:

asyncRef[kIOAsyncReservedIndex] |= 1; // (kIOUCAsync64Flag)


Configuration:
Anything running 10.9.x. May exist in prior versions but have not investigated.

Attachments: