Changeset 15757 in vbox

Timestamp:

Dec 25, 2008 2:13:46 PM (16 years ago)

Author:

vboxsync

Message:

SrvIntNetR0: fix to not refer the freed memory

File:

• trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp (modified) (6 diffs)

trunk/src/VBox/Devices/Network/SrvIntNetR0.cpp

@@ -547 +547 @@
  * by handle lookup/freeing.
  *
- * @returns VBox status code, can assume success in most situations.
+ * @returns false in case the pIf was deleted as a result of this call, false otherwise
  * @param   pIf                 The interface instance.
  * @param   pSession            The current session.
  */
-DECLINLINE(void) intnetR0IfRelease(PINTNETIF pIf, PSUPDRVSESSION pSession)
+DECLINLINE(bool) intnetR0IfRelease(PINTNETIF pIf, PSUPDRVSESSION pSession)
 {
     int rc = SUPR0ObjRelease(pIf->pvObj, pSession);
     AssertRC(rc);
+    if(!pIf->pvObj)
+    {
+        RTMemFree(pIf);
+        return false;
+    }
+    return true;
 }
 
@@ -3047 +3053 @@
         if (!pIf->fDestroying)
         {
-            intnetR0IfRelease(pIf, pSession);
-            if (pIf->hIf != hIf)
+            if(!intnetR0IfRelease(pIf, pSession))
                 rc = VERR_SEM_DESTROYED;
         }
@@ -3108 +3113 @@
     RTSemEventSignal(pIf->Event);
 
-    void *pvObj = pIf->pvObj;
     intnetR0IfRelease(pIf, pSession); /* (RTHandleTableFreeWithCtx) */
 
-    int rc = SUPR0ObjRelease(pvObj, pSession);
+    intnetR0IfRelease(pIf, pSession);
+
+    int rc = VINF_SUCCESS;
     LogFlow(("INTNETR0IfClose: returns %Rrc\n", rc));
     return rc;
@@ -3166 +3172 @@
     }
 
-    /*
+     /*
      * If we've got a network deactivate and unlink ourselves from it.
      * Because of cleanup order we might be an orphan now.
@@ -3259 +3265 @@
      */
     pIf->pvObj = NULL;
-    RTMemFree(pIf);
+    /*
+     * we are freeing it in
+     * intnetR0IfRelease
+     * RTMemFree(pIf);
+     */
 }
 
@@ -3386 +3396 @@
                     }
 
-                    SUPR0ObjRelease(pIf->pvObj, pSession);
+                    intnetR0IfRelease(pIf, pSession);
                     LogFlow(("intnetR0NetworkCreateIf: returns %Rrc\n", rc));
                     return rc;