Changeset 65808 in vbox

Timestamp:

Feb 20, 2017 11:41:59 AM (8 years ago)

Author:

vboxsync

Message:

Devices/Network/lwip-new: the mailbox uses pointers to the message. As we don't know when the message is consumed, don't pass a pointer to a local stack variable but always allocate a message. This could fix a potential crash of VBoxNetNAT during shutdown (when handling the a problem in our code for terminating the lwip stack. A mailbox is used to store the pointer to the TCPIP_MSG_CALLBACK_TERMINATE message).

Location:

trunk/src/VBox/Devices/Network/lwip-new

Files:

• src/api/tcpip.c (modified) (1 diff)
• vbox/VBoxLwipCore.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/Network/lwip-new/src/api/tcpip.c

@@ -154 +154 @@
         msg->msg.cb.function(msg->msg.cb.ctx);
       }
+      memp_free(MEMP_TCPIP_MSG_API, msg);
       goto terminate;
 #endif

trunk/src/VBox/Devices/Network/lwip-new/vbox/VBoxLwipCore.cpp

@@ -133 +133 @@
             if (lwipRc != ERR_OK)
             {
-                LogFlow(("%s: sys_sem_new error %d\n", __FUNCTION__, lwipRc));
+                LogFlowFunc(("sys_sem_new error %d\n", lwipRc));
                 goto done;
             }
@@ -144 +144 @@
             if (lwipRc != ERR_OK)
             {
-                LogFlow(("%s: tcpip_callback error %d\n", __FUNCTION__, lwipRc));
+                LogFlowFunc(("tcpip_callback error %d\n", lwipRc));
                 goto done;
             }
@@ -191 +191 @@
              * gone in future versions of lwip.
              */
-            struct tcpip_msg msg;
-            msg.type = TCPIP_MSG_CALLBACK_TERMINATE;
-            msg.msg.cb.function = lwipCoreFiniDone;
-            msg.msg.cb.ctx = &callback;
-
-            lwipRc = tcpip_callbackmsg((struct tcpip_callback_msg *)&msg);
-            if (lwipRc != ERR_OK)
+            struct tcpip_msg *msg = (struct tcpip_msg *)memp_malloc(MEMP_TCPIP_MSG_API);
+            if (msg)
             {
-                LogFlow(("%s: tcpip_callback_msg error %d\n", __FUNCTION__, lwipRc));
+                msg->type = TCPIP_MSG_CALLBACK_TERMINATE;
+                msg->msg.cb.function = lwipCoreFiniDone;
+                msg->msg.cb.ctx = &callback;
+
+                lwipRc = tcpip_callbackmsg((struct tcpip_callback_msg *)msg);
+                if (lwipRc != ERR_OK)
+                    LogFlowFunc(("tcpip_callback_msg error %d\n", lwipRc));
             }
+            else
+                LogFlowFunc(("memp_malloc no memory\n"));
         }
         else
@@ -206 +209 @@
             lwipRc = tcpip_callback(lwipCoreUserCallback, &callback);
             if (lwipRc != ERR_OK)
-            {
-                LogFlow(("%s: tcpip_callback error %d\n", __FUNCTION__, lwipRc));
-            }
+                LogFlowFunc(("tcpip_callback error %d\n", lwipRc));
         }