1 files changed, 23 insertions, 100 deletions

diff --git a/ipc/attachment_broker_privileged_mac.cc b/ipc/attachment_broker_privileged_mac.cc
index 725085b..6b53ce0 100644
--- a/ipc/attachment_broker_privileged_mac.cc
+++ b/ipc/attachment_broker_privileged_mac.cc
@@ -8,6 +8,7 @@
 
 #include <tuple>
 
+#include "base/mac/mach_port_util.h"
 #include "base/mac/scoped_mach_port.h"
 #include "base/memory/shared_memory.h"
 #include "base/process/port_provider_mac.h"
@@ -18,49 +19,6 @@
 #include "ipc/ipc_channel.h"
 #include "ipc/mach_port_attachment_mac.h"
 
-namespace {
-
-// Struct for sending a complex Mach message.
-struct MachSendComplexMessage {
-  mach_msg_header_t header;
-  mach_msg_body_t body;
-  mach_msg_port_descriptor_t data;
-};
-
-// Sends a Mach port to |endpoint|. Assumes that |endpoint| is a send once
-// right. Takes ownership of |endpoint|.
-kern_return_t SendMachPort(mach_port_t endpoint,
-                           mach_port_t port_to_send,
-                           int disposition) {
-  MachSendComplexMessage send_msg;
-  send_msg.header.msgh_bits =
-      MACH_MSGH_BITS(MACH_MSG_TYPE_MOVE_SEND_ONCE, 0) | MACH_MSGH_BITS_COMPLEX;
-  send_msg.header.msgh_size = sizeof(send_msg);
-  send_msg.header.msgh_remote_port = endpoint;
-  send_msg.header.msgh_local_port = MACH_PORT_NULL;
-  send_msg.header.msgh_reserved = 0;
-  send_msg.header.msgh_id = 0;
-  send_msg.body.msgh_descriptor_count = 1;
-  send_msg.data.name = port_to_send;
-  send_msg.data.disposition = disposition;
-  send_msg.data.type = MACH_MSG_PORT_DESCRIPTOR;
-
-  kern_return_t kr =
-      mach_msg(&send_msg.header, MACH_SEND_MSG | MACH_SEND_TIMEOUT,
-               send_msg.header.msgh_size,
-               0,                // receive limit
-               MACH_PORT_NULL,   // receive name
-               0,                // timeout
-               MACH_PORT_NULL);  // notification port
-
-  if (kr != KERN_SUCCESS)
-    mach_port_deallocate(mach_task_self(), endpoint);
-
-  return kr;
-}
-
-}  // namespace
-
 namespace IPC {
 
 AttachmentBrokerPrivilegedMac::AttachmentBrokerPrivilegedMac(
@@ -232,61 +190,6 @@ bool AttachmentBrokerPrivilegedMac::RouteWireFormatToAnother(
   return true;
 }
 
-mach_port_name_t AttachmentBrokerPrivilegedMac::CreateIntermediateMachPort(
-    mach_port_t task_port,
-    base::mac::ScopedMachSendRight port_to_insert) {
-  DCHECK_NE(mach_task_self(), task_port);
-  DCHECK_NE(static_cast<mach_port_name_t>(MACH_PORT_NULL), task_port);
-
-  // Make a port with receive rights in the destination task.
-  mach_port_name_t endpoint;
-  kern_return_t kr =
-      mach_port_allocate(task_port, MACH_PORT_RIGHT_RECEIVE, &endpoint);
-  if (kr != KERN_SUCCESS) {
-    LogError(ERROR_MAKE_RECEIVE_PORT);
-    return MACH_PORT_NULL;
-  }
-
-  // Change its message queue limit so that it accepts one message.
-  mach_port_limits limits = {};
-  limits.mpl_qlimit = 1;
-  kr = mach_port_set_attributes(task_port, endpoint, MACH_PORT_LIMITS_INFO,
-                                reinterpret_cast<mach_port_info_t>(&limits),
-                                MACH_PORT_LIMITS_INFO_COUNT);
-  if (kr != KERN_SUCCESS) {
-    LogError(ERROR_SET_ATTRIBUTES);
-    mach_port_deallocate(task_port, endpoint);
-    return MACH_PORT_NULL;
-  }
-
-  // Get a send right.
-  mach_port_t send_once_right;
-  mach_msg_type_name_t send_right_type;
-  kr =
-      mach_port_extract_right(task_port, endpoint, MACH_MSG_TYPE_MAKE_SEND_ONCE,
-                              &send_once_right, &send_right_type);
-  if (kr != KERN_SUCCESS) {
-    LogError(ERROR_EXTRACT_DEST_RIGHT);
-    mach_port_deallocate(task_port, endpoint);
-    return MACH_PORT_NULL;
-  }
-  DCHECK_EQ(static_cast<mach_msg_type_name_t>(MACH_MSG_TYPE_PORT_SEND_ONCE),
-            send_right_type);
-
-  // This call takes ownership of |send_once_right|.
-  kr = SendMachPort(
-      send_once_right, port_to_insert.get(), MACH_MSG_TYPE_COPY_SEND);
-  if (kr != KERN_SUCCESS) {
-    LogError(ERROR_SEND_MACH_PORT);
-    mach_port_deallocate(task_port, endpoint);
-    return MACH_PORT_NULL;
-  }
-
-  // Endpoint is intentionally leaked into the destination task. An IPC must be
-  // sent to the destination task so that it can clean up this port.
-  return endpoint;
-}
-
 base::mac::ScopedMachSendRight AttachmentBrokerPrivilegedMac::ExtractNamedRight(
     mach_port_t task_port,
     mach_port_name_t named_right) {
@@ -367,8 +270,28 @@ bool AttachmentBrokerPrivilegedMac::SendPrecursor(
   base::mac::ScopedMachSendRight port_to_insert = precursor->TakePort();
   mach_port_name_t intermediate_port = MACH_PORT_NULL;
   if (port_to_insert.get() != MACH_PORT_NULL) {
-    intermediate_port = CreateIntermediateMachPort(
-        task_port, base::mac::ScopedMachSendRight(port_to_insert.release()));
+    base::MachCreateError error_code;
+    intermediate_port = base::CreateIntermediateMachPort(
+        task_port, base::mac::ScopedMachSendRight(port_to_insert.release()),
+        &error_code);
+    if (intermediate_port == MACH_PORT_NULL) {
+      UMAError uma_error;
+      switch (error_code) {
+        case base::MachCreateError::ERROR_MAKE_RECEIVE_PORT:
+          uma_error = ERROR_MAKE_RECEIVE_PORT;
+          break;
+        case base::MachCreateError::ERROR_SET_ATTRIBUTES:
+          uma_error = ERROR_SET_ATTRIBUTES;
+          break;
+        case base::MachCreateError::ERROR_EXTRACT_DEST_RIGHT:
+          uma_error = ERROR_EXTRACT_DEST_RIGHT;
+          break;
+        case base::MachCreateError::ERROR_SEND_MACH_PORT:
+          uma_error = ERROR_SEND_MACH_PORT;
+          break;
+      }
+      LogError(uma_error);
+    }
   }
   return RouteWireFormatToAnother(
       CopyWireFormat(wire_format, intermediate_port));