As mentioned in p0  bug 973 /followup 651078322 the IORegistryEntry::getProperty function
returns a pointer to a registry value without taking a reference on it.

Pretty much the only safe thing you can do with this API is check whether a registry entry
recently had a property with the given key - you can't hold the registry lock when calling this function
as it takes that lock so it really almost impossible to call safely if you want to use the return value
for anything other than comparing to NULL.

Here's another case of a bad use of getProperty in IOService.cpp:

    // First try my own properties for a user client class name
    temp = getProperty(gIOUserClientClassKey); // <-- temp can be freed any time after this
    if (temp) {
        if (OSDynamicCast(OSSymbol, temp))
            userClientClass = (const OSSymbol *) temp;
        else if (OSDynamicCast(OSString, temp)) {
            userClientClass = OSSymbol::withString((OSString *) temp);  // <-- will call virtual method on temp
            if (userClientClass)
                setProperty(kIOUserClientClassKey,
                            (OSObject *) userClientClass);
        }
    }

Tested on MacBookAir5,2 MacOS Sierra 10.12.1 (16B2555)
 

ucproprace.c 2.6 KB View Download