On Mon, Nov 1, 2021 at 12:32 PM Joan Lledó <jlle...@mailfence.com> wrote: > +kern_return_t > +memory_object_get_proxy (task_t task, const vm_offset_t address, > + vm_prot_t max_protection, vm_offset_t len, > + ipc_port_t *port) > +{ > + kern_return_t err;
Super minor nitpick: this variable is typically named 'kr' or 'ret', it would seem. 'err' is more of a userspace thing with glibc's error_t. > + vm_map_lock_read(task->map); > + if (!vm_map_lookup_entry(task->map, address, &tmp_entry)) { > + if ((entry = tmp_entry->vme_next) == vm_map_to_entry(task->map)) { > + vm_map_unlock_read(task->map); > + return(KERN_NO_SPACE); > + } > + } else { > + entry = tmp_entry; > + } > + > + /* Limit the allowed protection and range to the entry ones */ > + if (len > entry->vme_end - entry->vme_start) > + return(KERN_INVALID_ARGUMENT); You also need to unlock the map here. > + pager = ipc_port_copy_send(entry->object.vm_object->pager); > + offset = entry->offset; > + start = 0; > + > + vm_map_unlock_read(task->map); > + > + err = memory_object_create_proxy(task->itk_space, max_protection, > + &pager, 1, > + &offset, 1, > + &start, 1, > + &len, 1, port); > + if (err) > + ipc_port_release_send(pager); > + > + return err; Yes, this looks correct now, at least as far as I understand kernel internals. Thank you! :) Sergey