Changeset 25484 in vbox for trunk/src/VBox/HostDrivers

Timestamp:

Dec 18, 2009 2:04:56 PM (15 years ago)

Author:

vboxsync

Message:

SUPDrv: Fixed recent regression that may cause the SUPDRVSESSION allocation to be too small on some platforms, and thereby corrupting heap or/and triggering system panic.

Location:

trunk/src/VBox/HostDrivers/Support

Files:

• SUPDrv.c (modified) (4 diffs)
• SUPDrvInternal.h (modified) (2 diffs)
• darwin/SUPDrv-darwin.cpp (modified) (1 diff)
• freebsd/SUPDrv-freebsd.c (modified) (1 diff)
• linux/SUPDrv-linux.c (modified) (2 diffs)
• os2/SUPDrv-os2.cpp (modified) (1 diff)
• solaris/SUPDrv-solaris.c (modified) (1 diff)
• win/SUPDrv-win.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPDrv.c

@@ -337 +337 @@
  * @returns IPRT status code.
  * @param   pDevExt     The device extension to initialize.
- */
-int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt)
+ * @param   cbSession   The size of the session structure.  The size of
+ *                      SUPDRVSESSION may be smaller when SUPDRV_AGNOSTIC is
+ *                      defined because we're skipping the OS specific members
+ *                      then.
+ */
+int VBOXCALL supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession)
 {
     int rc;
@@ -385 +389 @@
                     {
                         pDevExt->u32Cookie = BIRD;  /** @todo make this random? */
+                        pDevExt->cbSession = cbSession;
 
                         /*
@@ -554 +559 @@
      * Allocate memory for the session data.
      */
-    int rc = VERR_NO_MEMORY;
-    PSUPDRVSESSION pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(sizeof(*pSession));
+    int             rc;
+    PSUPDRVSESSION  pSession = *ppSession = (PSUPDRVSESSION)RTMemAllocZ(pDevExt->cbSession);
     if (pSession)
     {
@@ -599 +604 @@
         Log(("Failed to create spinlock, rc=%d!\n", rc));
     }
+    else
+        rc = VERR_NO_MEMORY;
 
     return rc;

trunk/src/VBox/HostDrivers/Support/SUPDrvInternal.h

@@ -465 +465 @@
     /** Global cookie. */
     uint32_t                        u32Cookie;
-
-    /** The IDT entry number.
-     * Only valid if pIdtPatches is set. */
-    uint8_t volatile                u8Idt;
+    /** The actual size of SUPDRVSESSION. (SUPDRV_AGNOSTIC) */
+    uint32_t                        cbSession;
 
     /** Loader mutex.
@@ -600 +598 @@
 int  VBOXCALL   supdrvIOCtlFast(uintptr_t uIOCtl, VMCPUID idCpu, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession);
 int  VBOXCALL   supdrvIDC(uintptr_t uIOCtl, PSUPDRVDEVEXT pDevExt, PSUPDRVSESSION pSession, PSUPDRVIDCREQHDR pReqHdr);
-int  VBOXCALL   supdrvInitDevExt(PSUPDRVDEVEXT pDevExt);
+int  VBOXCALL   supdrvInitDevExt(PSUPDRVDEVEXT pDevExt, size_t cbSession);
 void VBOXCALL   supdrvDeleteDevExt(PSUPDRVDEVEXT pDevExt);
 int  VBOXCALL   supdrvCreateSession(PSUPDRVDEVEXT pDevExt, bool fUser, PSUPDRVSESSION *ppSession);

trunk/src/VBox/HostDrivers/Support/darwin/SUPDrv-darwin.cpp

@@ -235 +235 @@
          * Initialize the device extension.
          */
-        rc = supdrvInitDevExt(&g_DevExt);
+        rc = supdrvInitDevExt(&g_DevExt, sizeof(SUPDRVSESSION));
         if (RT_SUCCESS(rc))
         {

trunk/src/VBox/HostDrivers/Support/freebsd/SUPDrv-freebsd.c

@@ -172 +172 @@
          * Initialize the device extension.
          */
-        rc = supdrvInitDevExt(&g_VBoxDrvFreeBSDDevExt);
+        rc = supdrvInitDevExt(&g_VBoxDrvFreeBSDDevExt, sizeof(SUPDRVSESSION));
         if (RT_SUCCESS(rc))
         {

trunk/src/VBox/HostDrivers/Support/linux/SUPDrv-linux.c

@@ -609 +609 @@
              */
             if (RT_SUCCESS(rc))
-                rc = supdrvInitDevExt(&g_DevExt);
+                rc = supdrvInitDevExt(&g_DevExt, sizeof(SUPDRVSESSION));
             if (RT_SUCCESS(rc))
             {
@@ -732 +732 @@
      * Call common code for the rest.
      */
-    rc = supdrvCreateSession(&g_DevExt, true /* fUser */, (PSUPDRVSESSION *)&pSession);
+    rc = supdrvCreateSession(&g_DevExt, true /* fUser */, &pSession);
     if (!rc)
     {

trunk/src/VBox/HostDrivers/Support/os2/SUPDrv-os2.cpp

@@ -102 +102 @@
          * Initialize the device extension.
          */
-        rc = supdrvInitDevExt(&g_DevExt);
+        rc = supdrvInitDevExt(&g_DevExt, sizeof(SUPDRVSESSION));
         if (RT_SUCCESS(rc))
         {

trunk/src/VBox/HostDrivers/Support/solaris/SUPDrv-solaris.c

@@ -212 +212 @@
          * Initialize the device extension
          */
-        rc = supdrvInitDevExt(&g_DevExt);
+        rc = supdrvInitDevExt(&g_DevExt, sizeof(SUPDRVSESSION));
         if (RT_SUCCESS(rc))
         {

trunk/src/VBox/HostDrivers/Support/win/SUPDrv-win.cpp

@@ -134 +134 @@
                 memset(pDevExt, 0, sizeof(*pDevExt));
 
-                vrc = supdrvInitDevExt(pDevExt);
+                vrc = supdrvInitDevExt(pDevExt, sizeof(SUPDRVSESSION));
                 if (!vrc)
                 {