Changeset 76145 in vbox for trunk/src/VBox/Devices/VMMDev

Timestamp:

Dec 11, 2018 12:16:18 AM (6 years ago)

Author:

vboxsync

svn:sync-xref-src-repo-rev:

127390

Message:

VMMDevHGCM: Fix handling of embedded buffers in the non-locked code path. bugref:9172

File:

• trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp (modified) (4 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -1191 +1191 @@
  * @param   pCmd            Completed call command.
  * @param   pHGCMCall       The guestrequest which needs updating (cached in the host memory).
- */
-static int vmmdevHGCMCompleteCallRequest(PVMMDEV pThis, PVBOXHGCMCMD pCmd, VMMDevHGCMCall *pHGCMCall)
+ * @param   pbReq           The request copy or locked memory for handling
+ *                          embedded buffers.
+ */
+static int vmmdevHGCMCompleteCallRequest(PVMMDEV pThis, PVBOXHGCMCMD pCmd, VMMDevHGCMCall *pHGCMCall, uint8_t *pbReq)
 {
     AssertReturn(pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_INTERNAL_ERROR);
@@ -1247 +1249 @@
                     uint32_t    cbSrc    = pHostParm->u.pointer.size;
                     uint32_t    cbToCopy = RT_MIN(cbSrc, pPtr->cbData);
-                    if (pCmd->pvReqLocked)
-                        memcpy((uint8_t *)pCmd->pvReqLocked + pPtr->offFirstPage, pvSrc, cbToCopy);
-                    else
-                        rc = PDMDevHlpPhysWrite(pThis->pDevInsR3, pGuestParm->u.ptr.GCPhysSinglePage, pvSrc, cbToCopy);
+                    memcpy(pbReq + pPtr->offFirstPage, pvSrc, cbToCopy);
                 }
                 break;
@@ -1346 +1345 @@
                         {
                             VMMDevHGCMCall *pHGCMCall = (VMMDevHGCMCall *)pHeader;
-                            rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall);
+                            rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall, (uint8_t *)pHeader);
 #ifdef VBOX_WITH_DTRACE
                             idFunction = pCmd->u.call.u32Function;
@@ -1429 +1428 @@
                     {
                         VMMDevHGCMCall *pHGCMCall = (VMMDevHGCMCall *)pHeader;
-                        rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall);
+                        rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall, (uint8_t *)pHeader);
 #ifdef VBOX_WITH_DTRACE
                         idFunction = pCmd->u.call.u32Function;