Repository navigation
aop, sio: reply-length heap overflow and stop completion (port from MakrSas/Inferno) - #59
Merged
Merged
Conversation
…m MakrSas/Inferno) An AOP endpoint reply holds the 4-byte result word followed by out_len bytes of payload. handle_command was given actual_out_payload, which already points past the result word, together with actual_out_len, which still counts the word. A handler that filled the buffer it was told about wrote 4 bytes past the end of the allocation, into the next heap block. MakrSas saw malloc later spin in the damaged free list with the guest stopped. Handlers are now given out_len. Ported from MakrSas/Inferno commit 181c83d ("aop: stop writing past the end of the reply buffer", branch ios) by Makr <ngrom33@gmail.com>, under the same licence as the file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…Inferno) A SIO DMA stop destroyed the buffers still queued on the channel and sent a bare completion. XNU's AppleSmartIODMA::_stopDMA sleeps, uninterruptibly, until the channel goes idle, and a channel goes idle only once every command it handed out has come back. A stream normally ends with a buffer or two still queued, so the stopping thread never woke. With audio, MakrSas saw this leave mediaserverd in TH_WAIT|TH_UNINT after the first stop; the watchdog then killed it and all sound was gone until reboot. Every buffer still out is now written back as completed, with its tag, the bytes done so far and its timestamps, ahead of the stop's own completion. Ported from MakrSas/Inferno commit 2a79c19 ("sio: hand back every transfer a stop leaves queued", branch ios) by Makr <ngrom33@gmail.com>, under the same licence as the file. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two fixes from MakrSas/Inferno (
iosbranch) by Makr, one commit each, with authorship kept. MakrSas found both while bringing up audio, but both affect every t8030 boot, so they are a PR of their own. The audio work (#24) needs the SIO fix for streams to stop cleanly.aop: handlers get the reply length without the result word (181c83d)
An AOP endpoint reply is a 4-byte result word followed by
out_lenbytes.handle_commandreceivedactual_out_payload, which already points past the word, together withactual_out_len, which still counts it. A handler that filled the buffer it was told about wrote 4 bytes into the next heap block. MakrSas saw malloc later spin in the corrupted free list. Handlers now getout_len.sio: a stop completes every transfer still queued (2a79c19)
apple_sio_dma_stopdestroyed the queued buffers and sent a bare completion. XNU'sAppleSmartIODMA::_stopDMAsleeps uninterruptibly until every command it handed out has come back, so a stop with buffers still queued never returned. With audio, that left mediaserverd in TH_UNINT until the watchdog killed it. Each queued buffer is now written back as completed (tag, bytes done, timestamps) before the stop's own completion. The forward declaration uses Pyre'sAppleSIOtype name.Testing
Android cross build on emulator-5554, together with #24, against master
d9118068e5:restore_bench.py, iOS 14.0 restore, real SEP,-smp 4): 3/3 runs reachedwaiting_hostwith no panic (10.0–10.1 s). Withaudio=on, 3/3 also reached it (10.3–11.8 s).🤖 Generated with Claude Code