ipc: Minor fixes to AttachmentBrokerPrivilegedMac.

ipc/attachment_broker_privileged_mac.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "ipc/attachment_broker_privileged_mac.h"
 
 #include "base/mac/scoped_mach_port.h"
 #include "base/memory/shared_memory.h"
 #include "base/process/port_provider_mac.h"
 #include "base/process/process.h"
@@ skipping 78 matching lines @@
       SendPrecursorsForProcess(wire_format.destination_process);
       return true;
     }
     default:
       NOTREACHED();
       return false;
   }
   return false;
 }
 
+void AttachmentBrokerPrivilegedMac::DeregisterCommunicationChannel(
+    Endpoint* endpoint) {
+  AttachmentBrokerPrivileged::DeregisterCommunicationChannel(endpoint);
+
+  if (!endpoint)
+    return;
+
+  base::ProcessId pid = endpoint->GetPeerPID();
+  if (pid == base::kNullProcessId)
+    return;
+
+  {
+    base::AutoLock l(precursors_lock_);
+    auto it = precursors_.find(pid);
+    if (it != precursors_.end()) {
+      delete it->second;
+      precursors_.erase(pid);
+    }
+  }
+
+  {
+    base::AutoLock l(extractors_lock_);
+    auto it = extractors_.find(pid);
+    if (it != extractors_.end()) {
+      delete it->second;
+      extractors_.erase(pid);
+    }
+  }
+}
+
 bool AttachmentBrokerPrivilegedMac::OnMessageReceived(const Message& msg) {
   bool handled = true;
   switch (msg.type()) {
     IPC_MESSAGE_HANDLER_GENERIC(AttachmentBrokerMsg_DuplicateMachPort,
                                 OnDuplicateMachPort(msg))
     IPC_MESSAGE_UNHANDLED(handled = false)
   }
   return handled;
 }
 
@@ skipping 53 matching lines @@
   DCHECK_EQ(base::Process::Current().Pid(), precursor->pid());
 
   // Intentionally leak the port, since the attachment takes ownership.
   internal::MachPortAttachmentMac::WireFormat wire_format(
       precursor->TakePort().release(), precursor->pid(), precursor->id());
   scoped_refptr<BrokerableAttachment> attachment(
       new internal::MachPortAttachmentMac(wire_format));
   HandleReceivedAttachment(attachment);
 }
 
-void AttachmentBrokerPrivilegedMac::RouteWireFormatToAnother(
+bool AttachmentBrokerPrivilegedMac::RouteWireFormatToAnother(
     const MachPortWireFormat& wire_format) {
   DCHECK_NE(wire_format.destination_process, base::Process::Current().Pid());
 
   // Another process is the destination.
   base::ProcessId dest = wire_format.destination_process;
   Sender* sender = GetSenderWithProcessId(dest);
   if (!sender) {
     // Assuming that this message was not sent from a malicious process, the
     // channel endpoint that would have received this message will block
     // forever.
     LOG(ERROR) << "Failed to deliver brokerable attachment to process with id: "
                << dest;
     LogError(DESTINATION_NOT_FOUND);
-    return;
+    return false;
   }
 
   LogError(DESTINATION_FOUND);
   sender->Send(new AttachmentBrokerMsg_MachPortHasBeenDuplicated(wire_format));
+  return true;
 }
 
 mach_port_name_t AttachmentBrokerPrivilegedMac::CreateIntermediateMachPort(
     mach_port_t task_port,
     base::mac::ScopedMachSendRight port_to_insert) {
   DCHECK_NE(mach_task_self(), task_port);
   DCHECK_NE(static_cast<mach_port_name_t>(MACH_PORT_NULL), task_port);
 
   // Make a port with receive rights in the destination task.
   mach_port_name_t endpoint;
@@ skipping 37 matching lines @@
     LogError(ERROR_SEND_MACH_PORT);
     mach_port_deallocate(task_port, endpoint);
     return MACH_PORT_NULL;
   }
 
   // Endpoint is intentionally leaked into the destination task. An IPC must be
   // sent to the destination task so that it can clean up this port.
   return endpoint;
 }
 
-base::mac::ScopedMachSendRight AttachmentBrokerPrivilegedMac::AcquireSendRight(
-    base::ProcessId pid,
-    mach_port_name_t named_right) {
-  if (pid == base::GetCurrentProcId()) {
-    kern_return_t kr = mach_port_mod_refs(mach_task_self(), named_right,
-                                          MACH_PORT_RIGHT_SEND, 1);
-    if (kr != KERN_SUCCESS)
-      return base::mac::ScopedMachSendRight(MACH_PORT_NULL);
-    return base::mac::ScopedMachSendRight(named_right);
-  }
-
-  mach_port_t task_port = port_provider_->TaskForPid(pid);
-  return ExtractNamedRight(task_port, named_right);
-}
-
 base::mac::ScopedMachSendRight AttachmentBrokerPrivilegedMac::ExtractNamedRight(
     mach_port_t task_port,
     mach_port_name_t named_right) {
   mach_port_t extracted_right = MACH_PORT_NULL;
   mach_msg_type_name_t extracted_right_type;
   kern_return_t kr =
       mach_port_extract_right(task_port, named_right, MACH_MSG_TYPE_COPY_SEND,
                               &extracted_right, &extracted_right_type);
   if (kr != KERN_SUCCESS) {
     LogError(ERROR_EXTRACT_SOURCE_RIGHT);
@@ skipping 25 matching lines @@
 void AttachmentBrokerPrivilegedMac::SendPrecursorsForProcess(
     base::ProcessId pid) {
   base::AutoLock l(precursors_lock_);
   auto it = precursors_.find(pid);
   if (it == precursors_.end())
     return;
 
   // Whether this process is the destination process.
   bool to_self = pid == base::GetCurrentProcId();
 
+  if (!to_self) {
+    if (!GetSenderWithProcessId(pid)) {
+      // If there is no sender, then the destination process is no longer
+      // running, or never existed to begin with.
+      LogError(DESTINATION_NOT_FOUND);
+      delete it->second;
+      precursors_.erase(it);
+      return;
+    }
+  }
+
   mach_port_t task_port = port_provider_->TaskForPid(pid);
+
+  // It's possible that the destination process has not yet provided the
+  // privileged process with its task port.
   if (!to_self && task_port == MACH_PORT_NULL)
     return;
 
   while (!it->second->empty()) {
     auto precursor_it = it->second->begin();
-    if (to_self)
+    if (to_self) {
       RoutePrecursorToSelf(*precursor_it);
-    else
-      SendPrecursor(*precursor_it, task_port);
+    } else {
+      if (!SendPrecursor(*precursor_it, task_port))
+        break;
+    }
     it->second->erase(precursor_it);
   }
 
   delete it->second;
   precursors_.erase(it);
 }
 
-void AttachmentBrokerPrivilegedMac::SendPrecursor(
+bool AttachmentBrokerPrivilegedMac::SendPrecursor(
     AttachmentPrecursor* precursor,
     mach_port_t task_port) {
   DCHECK(task_port);
   internal::MachPortAttachmentMac::WireFormat wire_format(
       MACH_PORT_NULL, precursor->pid(), precursor->id());
   base::mac::ScopedMachSendRight port_to_insert = precursor->TakePort();
   mach_port_name_t intermediate_port = MACH_PORT_NULL;
   if (port_to_insert.get() != MACH_PORT_NULL) {
     intermediate_port = CreateIntermediateMachPort(
         task_port, base::mac::ScopedMachSendRight(port_to_insert.release()));
   }
-  RouteWireFormatToAnother(CopyWireFormat(wire_format, intermediate_port));
+  return RouteWireFormatToAnother(
+      CopyWireFormat(wire_format, intermediate_port));
 }
 
 void AttachmentBrokerPrivilegedMac::AddPrecursor(
     base::ProcessId pid,
     base::mac::ScopedMachSendRight port,
     const BrokerableAttachment::AttachmentId& id) {
   base::AutoLock l(precursors_lock_);
   auto it = precursors_.find(pid);
   if (it == precursors_.end())
     precursors_[pid] = new ScopedVector<AttachmentPrecursor>;
 
   precursors_[pid]->push_back(new AttachmentPrecursor(
       pid, base::mac::ScopedMachSendRight(port.release()), id));
 }
 
 void AttachmentBrokerPrivilegedMac::ProcessExtractorsForProcess(
     base::ProcessId pid) {
   base::AutoLock l(extractors_lock_);
   auto it = extractors_.find(pid);
   if (it == extractors_.end())
     return;
 
+  if (!GetSenderWithProcessId(pid)) {
+    // If there is no sender, then the source process is no longer running.
+    LogError(ERROR_SOURCE_NOT_FOUND);
+    delete it->second;
+    extractors_.erase(it);
+    return;
+  }
+
   mach_port_t task_port = port_provider_->TaskForPid(pid);
+
+  // It's possible that the source process has not yet provided the privileged
+  // process with its task port.
   if (task_port == MACH_PORT_NULL)
     return;
 
   while (!it->second->empty()) {
     auto extractor_it = it->second->begin();
     ProcessExtractor(*extractor_it, task_port);
     it->second->erase(extractor_it);
   }
 
   delete it->second;
@@ skipping 22 matching lines @@
 
   auto it = extractors_.find(source_pid);
   if (it == extractors_.end())
     extractors_[source_pid] = new ScopedVector<AttachmentExtractor>;
 
   extractors_[source_pid]->push_back(
       new AttachmentExtractor(source_pid, dest_pid, port, id));
 }
 
 }  // namespace IPC