Changeset 64020 in vbox for trunk/src/VBox/Devices

Timestamp:

Sep 26, 2016 4:47:34 PM (8 years ago)

Author:

vboxsync

Message:

AHCI: Must duplicate the request structure when saving the request for GET LOG PAGE later because we don't manage the request memory anymore

File:

• trunk/src/VBox/Devices/Storage/DevAHCI.cpp (modified) (3 diffs)

trunk/src/VBox/Devices/Storage/DevAHCI.cpp

@@ -5881 +5881 @@
     VBOXDD_AHCI_REQ_COMPLETED(pAhciReq, rcReq, pAhciReq->uOffset, pAhciReq->cbTransfer);
 
-    /*
-     * Clear the request structure from the active request list first so it doesn't get cancelled
-     * while we complete it. If the request is not in the active list anymore it was already canceled
-     * and we have to make sure to not copy anything to guest memory because the guest might use it
-     * for other things already.
-     */
-    bool fReqErrSaved = false;
-
     if (rcReq != VERR_PDM_MEDIAEX_IOREQ_CANCELED)
     {
@@ -5929 +5921 @@
             {
                 ahciReqSetStatus(pAhciReq, ID_ERR, ATA_STAT_READY | ATA_STAT_ERR);
-                fReqErrSaved = ASMAtomicCmpXchgPtr(&pAhciPort->pTaskErr, pAhciReq, NULL);
+                /*
+                 * We have to duplicate the request here as the underlying I/O
+                 * request will be freed later.
+                 */
+                PAHCIREQ pReqDup = (PAHCIREQ)RTMemDup(pAhciReq, sizeof(AHCIREQ));
+                if (   pReqDup
+                    && !ASMAtomicCmpXchgPtr(&pAhciPort->pTaskErr, pReqDup, NULL))
+                    RTMemFree(pReqDup);
             }
             else
@@ -6025 +6024 @@
         PDMDevHlpAsyncNotificationCompleted(pAhciPort->pDevInsR3);
 
-    /* Don't free the request yet when it is saved for the error log page. */
+    /* Don't free the request if it is on the stack. */
     if (   pAhciReq
-        && !(pAhciReq->fFlags & AHCI_REQ_IS_ON_STACK)
-        && !fReqErrSaved)
+        && !(pAhciReq->fFlags & AHCI_REQ_IS_ON_STACK))
         ahciR3ReqFree(pAhciPort, pAhciReq);
     return fCanceled;