Changeset 16653 in vbox for trunk/src/VBox/Devices/Network

Timestamp:

Feb 11, 2009 8:56:10 AM (16 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

42639

Message:

NAT: fixed memmory corruption in new Unix multiplexing mechanism

Location:

trunk/src/VBox/Devices/Network

Files:

• DrvNAT.cpp (modified) (4 diffs)
• slirp/if.c (modified) (1 diff)
• slirp/ip_icmp.c (modified) (1 diff)
• slirp/slirp.c (modified) (7 diffs)
• slirp/socket.c (modified) (2 diffs)

trunk/src/VBox/Devices/Network/DrvNAT.cpp

@@ -43 +43 @@
 # ifndef RT_OS_WINDOWS
 #  include <unistd.h>
+#  include <fcntl.h>
 #  include <poll.h>
 # endif
@@ -350 +351 @@
     unsigned int cBreak = 0;
 # else
-    struct pollfd *polls;
+    struct pollfd *polls = NULL;
 # endif
 
@@ -374 +375 @@
 # ifndef RT_OS_WINDOWS
         nFDs = slirp_get_nsock(pThis->pNATState);
-        polls = (struct pollfd *)RTMemAllocZ((2 + nFDs) * sizeof(struct pollfd)); /* allocation for all sockets + ICMP and Management pipe*/
+        polls = NULL;
+        polls = (struct pollfd *)RTMemAlloc((1 + nFDs) * sizeof(struct pollfd) + sizeof(uint32_t)); /* allocation for all sockets + Management pipe*/
         if (polls == NULL)
         {
             LogRel(("Can't allocate memory for polling\n"));
-            AssertRelease(polls);
+            return VERR_NO_MEMORY;
         }
 
@@ -386 +388 @@
         polls[0].fd = pThis->PipeRead;
         polls[0].events = POLLRDNORM|POLLPRI|POLLRDBAND; /* POLLRDBAND usually doesn't used on Linux but seems used on Solaris */
-        int cChangedFDs = poll(polls, nFDs + 2, ms ? ms : -1);
+        polls[0].revents = 0;
+
+        int cChangedFDs = poll(polls, nFDs + 1, ms ? ms : -1);
+        AssertRelease(cChangedFDs >= 0);
         if (cChangedFDs >= 0)
         {
-            slirp_select_poll(pThis->pNATState, &polls[1], nFDs + 1);
+            slirp_select_poll(pThis->pNATState, &polls[1], nFDs);
             if (polls[0].revents & (POLLRDNORM|POLLPRI|POLLRDBAND))
             {

trunk/src/VBox/Devices/Network/slirp/if.c

@@ -186 +186 @@
     {
         /* check if we can really output */
-        if (!slirp_can_output(pData->pvUser)) 
+        if (!slirp_can_output(pData->pvUser))
         {
             Log(("if_start: can't send\n"));

trunk/src/VBox/Devices/Network/slirp/ip_icmp.c

@@ -101 +101 @@
     }
     fd_nonblock(pData->icmp_socket.s);
+    NSOCK_INC();
 #else /* RT_OS_WINDOWS */
     pData->hmIcmpLibrary = LoadLibrary("Iphlpapi.dll");

trunk/src/VBox/Devices/Network/slirp/slirp.c

@@ -33 +33 @@
 #  define DO_UNIX_CHECK_FD_SET(so, events, fdset )  0 /*specific for Unix API */
 # else /* !VBOX_WITH_SIMPLIFIED_SLIRP_SYNC */
-#  define DO_ENGAGE_EVENT1(so, fdset, label)            \
-    do {                                                \
-        polls[poll_index].fd = (so)->s;                 \
-        (so)->so_poll_index = poll_index;               \
-        polls[poll_index].events = N_(fdset ## _poll);  \
-        poll_index++;                                   \
+#  define DO_ENGAGE_EVENT1(so, fdset, label)                    \
+    do {                                                        \
+        AssertRelease(poll_index < (nfds));                     \
+        if(    so->so_poll_index != -1                          \
+            && so->s == polls[so->so_poll_index].fd) {          \
+            polls[poll_index].events |= N_(fdset ## _poll);     \
+            break; /* out of this loop */                       \
+        }                                                       \
+        AssertRelease(poll_index >= 0 && poll_index < (nfds));  \
+        polls[poll_index].fd = (so)->s;                         \
+        (so)->so_poll_index = poll_index;                       \
+        polls[poll_index].events = N_(fdset ## _poll);          \
+        polls[poll_index].revents = 0;                          \
+        poll_index++;                                           \
     } while(0)
 
@@ -44 +52 @@
 #  define DO_ENGAGE_EVENT2(so, fdset1, fdset2, label)                           \
     do {                                                                        \
+        AssertRelease(poll_index < (nfds));                     \
+        if(    so->so_poll_index != -1                          \
+            && so->s == polls[so->so_poll_index].fd) {          \
+            polls[poll_index].events |= N_(fdset1 ## _poll) | N_(fdset1 ## _poll);  \
+            break; /* out of this loop */                       \
+        }                                                       \
         polls[poll_index].fd = (so)->s;                                         \
         (so)->so_poll_index = poll_index;                                       \
@@ -689 +703 @@
         QSOCKET_FOREACH(so, so_next, tcp)
         /* { */
+#if defined(VBOX_WITH_SIMPLIFIED_SLIRP_SYNC) && !defined(RT_OS_WINDOWS)
+            so->so_poll_index = -1;
+#endif
             STAM_COUNTER_INC(&pData->StatTCP);
 
@@ -758 +775 @@
 
             STAM_COUNTER_INC(&pData->StatUDP);
+#if defined(VBOX_WITH_SIMPLIFIED_SLIRP_SYNC) && !defined(RT_OS_WINDOWS)
+            so->so_poll_index = -1;
+#endif
 
             /*
@@ -801 +821 @@
     *pnfds = VBOX_EVENT_COUNT;
 # else /* RT_OS_WINDOWS */
+    AssertRelease(poll_index <= *pnfds);
     *pnfds = poll_index;
 # endif /* !RT_OS_WINDOWS */
@@ -924 +945 @@
 
             LOG_NAT_SOCK(so, TCP, &NetworkEvents, readfds, writefds, xfds);
+
 
             /*
@@ -1089 +1111 @@
                     so->so_state = SS_NOFDREF;
                     TCP_INPUT(pData, (struct mbuf *)NULL, sizeof(struct ip), so);
+                    CONTINUE(tcp);
                 }
                 /* Here should be other error handlings */
+                AssertRelease(!"shouldn't be here!!!");
             }
 #endif

trunk/src/VBox/Devices/Network/slirp/socket.c

@@ -66 +66 @@
         so->so_state = SS_NOFDREF;
         so->s = -1;
+#if defined(VBOX_WITH_SIMPLIFIED_SLIRP_SYNC) && !defined(RT_OS_WINDOWS)
+        so->so_poll_index = -1;
+#endif
     }
     return so;
@@ -89 +92 @@
 #ifndef VBOX_WITH_SLIRP_MT
     if(so->so_next && so->so_prev)
+    {
         remque(pData, so);  /* crashes if so is not in a queue */
         NSOCK_DEC();
-    so->so_state = SS_NOFDREF; /* for debugging purposes */
+    }
 
     RTMemFree(so);