The clientMemoryForType method of AppleUSBMultitouchUserClient creates an AppleMultitouchIODataQueue
and maps it into kernel/user shared memory. AppleMultitouchIODataQueue inherits from IODataQueue.

The memory which is mapped into userspace is represented by the variable-sized struct IODataQueueMemory:

typedef struct _IODataQueueMemory {
      UInt32 queueSize;
      volatile UInt32 head;
      volatile UInt32 tail;
      IODataQueueEntry queue[1];
} IODataQueueMemory;

These queueSize, head and tail values are used to ensure that the enqueued items stay within the bounds of the queue. Userspace can modify the queueSize, head and tail values such that the kernel will try to enqueue a value to the queue outside of the allocated memory.
 

apple_usb_multitouch_enqueue.c 2.3 KB Download