Changeset 93991 in vbox for trunk/src/VBox/VMM

Timestamp:

Feb 28, 2022 4:29:55 PM (3 years ago)

Author:

vboxsync

Message:

VMM: Fix a possible PDM queue leak when destroying a VM, bugref:10093

Location:

trunk/src/VBox/VMM

Files:

• VMMR3/PDM.cpp (modified) (1 diff)
• VMMR3/PDMQueue.cpp (modified) (2 diffs)
• include/PDMInternal.h (modified) (1 diff)

trunk/src/VBox/VMM/VMMR3/PDM.cpp

@@ -888 +888 @@
 
     /*
+     * Cleanup any leftover queues.
+     */
+    pdmR3QueueTerm(pVM);
+
+    /*
      * Destroy the PDM lock.
      */

trunk/src/VBox/VMM/VMMR3/PDMQueue.cpp

@@ -433 +433 @@
                 hQueue--;
             pVM->pdm.s.cRing3Queues = hQueue;
-            /** @todo this should be done by PDMR3Term not here. */
-            if (!hQueue)
-            {
-                pVM->pdm.s.cRing3QueuesAlloc = 0;
-                PPDMQUEUE *papQueuesOld = ASMAtomicXchgPtrT(&pVM->pdm.s.papRing3Queues, NULL, PPDMQUEUE *);
-                RTMemFree(papQueuesOld);
-            }
         }
         pQueue->u32Magic = PDMQUEUE_MAGIC_DEAD;
@@ -801 +794 @@
 }
 
+
+/**
+ * Terminate the queues, freeing any resources still allocated.
+ *
+ * @returns nothing.
+ * @param   pVM                 The cross-context VM structure.
+ */
+DECLHIDDEN(void) pdmR3QueueTerm(PVM pVM)
+{
+    if (pVM->pdm.s.papRing3Queues)
+    {
+        /*
+         * Free the R3 queue handle array.
+         */
+        PDMQUEUEHANDLE cQueues = pVM->pdm.s.cRing3Queues;
+        for (PDMQUEUEHANDLE i = 0; i < cQueues; i++)
+            if (pVM->pdm.s.papRing3Queues[i])
+            {
+                PPDMQUEUE pQueue = pVM->pdm.s.papRing3Queues[i];
+
+                PDMR3QueueDestroy(pVM, RT_ELEMENTS(pVM->pdm.s.apRing0Queues) + i, pQueue->u.Gen.pvOwner);
+                Assert(!pVM->pdm.s.papRing3Queues[i]);
+            }
+
+        RTMemFree(pVM->pdm.s.papRing3Queues);
+        pVM->pdm.s.cRing3QueuesAlloc = 0;
+        pVM->pdm.s.papRing3Queues    = NULL;
+    }
+}

trunk/src/VBox/VMM/include/PDMInternal.h

@@ -1809 +1809 @@
 void        pdmR3BlkCacheTerm(PVM pVM);
 int         pdmR3BlkCacheResume(PVM pVM);
+
+DECLHIDDEN(void) pdmR3QueueTerm(PVM pVM);
 #endif /* IN_RING3 */