Changeset 66665 in vbox for trunk

Timestamp:

Apr 24, 2017 6:45:16 PM (8 years ago)

Author:

vboxsync

Message:

Storage/VD: Don't access any members of the I/O context after calling the completion handler if the I/O context is not going to be destroyed by the code calling the completion handler. Fixes crashes with synchronous I/O where the context lives on the stack and might not be valid anymore when the completion handler returned

File:

• trunk/src/VBox/Storage/VD.cpp (modified) (5 diffs)

trunk/src/VBox/Storage/VD.cpp

@@ -1452 +1452 @@
             LogFlowFunc(("Waiting I/O context completed pTmp=%#p\n", pTmp));
             vdThreadFinishWrite(pDisk);
+
+            bool fFreeCtx = RT_BOOL(!(pTmp->fFlags & VDIOCTX_FLAGS_DONT_FREE));
             vdIoCtxRootComplete(pDisk, pTmp);
-            vdIoCtxFree(pDisk, pTmp);
+
+            if (fFreeCtx)
+                vdIoCtxFree(pDisk, pTmp);
         }
     }
@@ -1507 +1511 @@
             LogFlowFunc(("Waiting I/O context completed pTmp=%#p\n", pTmp));
             vdThreadFinishWrite(pDisk);
+
+            bool fFreeCtx = RT_BOOL(!(pTmp->fFlags & VDIOCTX_FLAGS_DONT_FREE));
             vdIoCtxRootComplete(pDisk, pTmp);
-            vdIoCtxFree(pDisk, pTmp);
+            if (fFreeCtx)
+                vdIoCtxFree(pDisk, pTmp);
         }
     }
@@ -3352 +3359 @@
         {
             LogFlowFunc(("I/O context completed pIoCtx=%#p\n", pIoCtx));
+            bool fFreeCtx = RT_BOOL(!(pIoCtx->fFlags & VDIOCTX_FLAGS_DONT_FREE));
             if (pIoCtx->pIoCtxParent)
             {
@@ -3389 +3397 @@
                 {
                     LogFlowFunc(("Parent I/O context completed pIoCtxParent=%#p rcReq=%Rrc\n", pIoCtxParent, pIoCtxParent->rcReq));
+                    bool fFreeParentCtx = RT_BOOL(!(pIoCtxParent->fFlags & VDIOCTX_FLAGS_DONT_FREE));
                     vdIoCtxRootComplete(pDisk, pIoCtxParent);
                     vdThreadFinishWrite(pDisk);
-                    vdIoCtxFree(pDisk, pIoCtxParent);
+
+                    if (fFreeParentCtx)
+                        vdIoCtxFree(pDisk, pIoCtxParent);
                     vdDiskProcessBlockedIoCtx(pDisk);
                 }
@@ -3420 +3431 @@
             }
 
-            vdIoCtxFree(pDisk, pIoCtx);
+            if (fFreeCtx)
+                vdIoCtxFree(pDisk, pIoCtx);
         }
     }