Changeset 41467 in vbox for trunk/src/VBox/Devices/Storage

Timestamp:

May 28, 2012 10:49:45 PM (13 years ago)

Author:

vboxsync

Message:

AHCI: Fix possible guest memory corruption, it is possible that timed out requests were not canceled properly because they were not added to the task cache yet

File:

• trunk/src/VBox/Devices/Storage/DevAHCI.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/Storage/DevAHCI.cpp

@@ -5696 +5696 @@
         }
 
-        /* Add the task to the cache. */
-        ASMAtomicWritePtr(&pAhciPort->aCachedTasks[pAhciReq->uTag], pAhciReq);
         AssertReleaseMsg(ASMAtomicReadU32(&pAhciPort->cTasksActive) > 0 ,
                          ("Inconsistent request counter\n"));
@@ -6198 +6196 @@
                 AssertMsg(pAhciReq, ("%s: Cannot allocate task state memory!\n"));
                 pAhciReq->enmTxState = AHCITXSTATE_FREE;
+                pAhciPort->aCachedTasks[idx] = pAhciReq;
             }
             else
@@ -6233 +6232 @@
                     pAhciPort->fResetDevice = true;
                     ahciSendD2HFis(pAhciPort, pAhciReq, pAhciReq->cmdFis, true);
-                    pAhciPort->aCachedTasks[idx] = pAhciReq;
 
                     ASMAtomicCmpXchgSize(&pAhciReq->enmTxState, AHCITXSTATE_FREE, AHCITXSTATE_ACTIVE, fXchg);
@@ -6242 +6240 @@
                 {
                     ahciFinishStorageDeviceReset(pAhciPort, pAhciReq);
-                    pAhciPort->aCachedTasks[idx] = pAhciReq;
 
                     ASMAtomicCmpXchgSize(&pAhciReq->enmTxState, AHCITXSTATE_FREE, AHCITXSTATE_ACTIVE, fXchg);