Changeset 53717 in vbox for trunk/src/VBox/Runtime/r0drv

Timestamp:

Jan 2, 2015 4:28:08 PM (10 years ago)

Author:

vboxsync

Message:

IPRT/r0drv/nt: Fixed crash in rtmpNtDPCWrapper.

Location:

trunk/src/VBox/Runtime/r0drv

Files:

• mp-r0drv.h (modified) (1 diff)
• nt/mp-r0drv-nt.cpp (modified) (5 diffs)

trunk/src/VBox/Runtime/r0drv/mp-r0drv.h

@@ -54 +54 @@
     RTCPUID     idCpu;
     uint32_t volatile cHits;
+#ifdef RT_OS_WINDOWS
+    /** Turns out that KeFlushQueuedDpcs doesn't necessarily wait till all
+     * callbacks are done.  So, do reference counting to make sure we don't free
+     * this structure befor all CPUs have completely handled their requests.  */
+    int32_t volatile  cRefs;
+#endif
 #ifdef RT_OS_LINUX
     PRTCPUSET   pWorkerSet;

trunk/src/VBox/Runtime/r0drv/nt/mp-r0drv-nt.cpp

@@ -199 +199 @@
     PRTMPARGS pArgs = (PRTMPARGS)DeferredContext;
     ASMAtomicIncU32(&pArgs->cHits);
+
     pArgs->pfnWorker(KeGetCurrentProcessorNumber(), pArgs->pvUser1, pArgs->pvUser2);
+
+    /* Dereference the argument structure. */
+    int32_t cRefs = ASMAtomicDecS32(&pArgs->cRefs);
+    Assert(cRefs >= 0);
+    if (cRefs == 0)
+        ExFreePool(pArgs);
 }
 
@@ -246 +253 @@
     pArgs->idCpu     = NIL_RTCPUID;
     pArgs->cHits     = 0;
+    pArgs->cRefs     = 1;
 
     paExecCpuDpcs = (KDPC *)(pArgs + 1);
@@ -276 +284 @@
      * If someone knows a better way to get this done, please let bird know.
      */
+    ASMCompilerBarrier(); /* paranoia */
     if (enmCpuid == RT_NT_CPUID_SPECIFIC)
     {
+        ASMAtomicIncS32(&pArgs->cRefs);
         BOOLEAN ret = KeInsertQueueDpc(&paExecCpuDpcs[0], 0, 0);
         Assert(ret);
@@ -290 +300 @@
                 &&  (Mask & RT_BIT_64(i)))
             {
+                ASMAtomicIncS32(&pArgs->cRefs);
                 BOOLEAN ret = KeInsertQueueDpc(&paExecCpuDpcs[i], 0, 0);
                 Assert(ret);
@@ -303 +314 @@
     /** @todo Consider changing this to an active wait using some atomic inc/dec
      *  stuff (and check for the current cpu above in the specific case). */
+    /** @todo Seems KeFlushQueuedDpcs doesn't wait for the DPCs to be completely
+     *        executed. Seen pArgs being freed while some CPU was using it before
+     *        cRefs was added. */
     g_pfnrtNtKeFlushQueuedDpcs();
 
-    ExFreePool(pArgs);
+    /* Dereference the argument structure. */
+    int32_t cRefs = ASMAtomicDecS32(&pArgs->cRefs);
+    Assert(cRefs >= 0);
+    if (cRefs == 0)
+        ExFreePool(pArgs);
+
     return VINF_SUCCESS;
 }