Changeset 32338 in vbox

Timestamp:

Sep 9, 2010 11:12:45 AM (14 years ago)

Author:

vboxsync

Message:

NetFlt/win: fix possible stack overflow for loopback handling on heavy network load

Location:

trunk/src/VBox/HostDrivers/VBoxNetFlt/win

Files:

• VBoxNetFltCommon-win.h (modified) (1 diff)
• VBoxNetFltPt-win.c (modified) (4 diffs)

trunk/src/VBox/HostDrivers/VBoxNetFlt/win/VBoxNetFltCommon-win.h

@@ -366 +366 @@
     /** number of packets in the aReceivedPackets array*/
     ULONG                          cReceivedPacketCount;
+    /** flag indicating whether rx packet queueing is allowed */
+    BOOLEAN                        bIsReceivePacketQueueingDisabled;
     /** packet filter flags set by the upper protocols */
     ULONG                          fUpperProtocolSetFilter;

trunk/src/VBox/HostDrivers/VBoxNetFlt/win/VBoxNetFltPt-win.c

@@ -328 +328 @@
 
         pAdapt->cReceivedPacketCount = 0;
+        /* reset the value in case */
+        pAdapt->bIsReceivePacketQueueingDisabled = FALSE;
         ReturnPackets = TRUE;
     }
@@ -876 +878 @@
          */
 
-        if ((pAdapt->cReceivedPacketCount == MAX_RECEIVE_PACKET_ARRAY_SIZE) || DoIndicate || bReturn)
+        if ((pAdapt->cReceivedPacketCount == MAX_RECEIVE_PACKET_ARRAY_SIZE) || DoIndicate || bReturn
+                || pAdapt->bIsReceivePacketQueueingDisabled)
         {
             NdisMoveMemory(PacketArray,
@@ -891 +894 @@
             {
                 DoIndicate = TRUE;
+                pAdapt->bIsReceivePacketQueueingDisabled = TRUE;
             }
         }
@@ -900 +904 @@
         if(DoIndicate)
         {
+            /* the tcp stack can send ACK packets right in the context of its PtReceive for this packet,
+             * and thoose (tcp-sent) packets can be looped back again.
+             * If this happens there is a possibility that new RX packets are received by us
+             * after we do this NdisMIndicateReceivePacket and before we do a new NdisMIndicateReceivePacket
+             * for the looped back tcp-sent packet.
+             * If we queue those newly received packets and indicate them together with the looped back packet
+             * with the latter NdisMIndicateReceivePacket, we may end up tcp stack sending ACKs in the context of its PtReceive again.
+             * Thus this may lead to stack overflows on a heavy network loads.
+             * To prevent this we disable the RX packet queuing when we do NdisMIndicateReceivePacket here,
+             * thus if new packets arrive to us in another thread, we simply indicate them up instead of queuing them.
+             * */
+            Assert(pAdapt->bIsReceivePacketQueueingDisabled);
             NdisMIndicateReceivePacket(pAdapt->hMiniportHandle, PacketArray, NumberOfPackets);
+            RTSpinlockAcquireNoInts(pNetFlt->hSpinlock, &Tmp);
+            pAdapt->bIsReceivePacketQueueingDisabled = FALSE;
+            RTSpinlockReleaseNoInts(pNetFlt->hSpinlock, &Tmp);
         }
     }