儲存庫 vbox 的更動 18355

時間撮記:

2009-3-26 下午10:18:55 (16 年 以前)

作者:

vboxsync

訊息:

pgmPoolCacheFreeOne: Rewrote recursion to a finit loop; overflowing the stack is bad both in RC (#DF) and R0 (panic/corruption).

檔案:

• trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp (修改) (1 筆差異)

trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp

@@ -1246 +1246 @@
      * Select one page from the tail of the age list.
      */
-    uint16_t iToFree = pPool->iAgeTail;
-    if (iToFree == iUser)
-        iToFree = pPool->aPages[iToFree].iAgePrev;
+    PPGMPOOLPAGE    pPage;
+    for (unsigned iLoop = 0; ; iLoop++)
+    {
+        uint16_t iToFree = pPool->iAgeTail;
+        if (iToFree == iUser)
+            iToFree = pPool->aPages[iToFree].iAgePrev;
 /* This is the alternative to the SyncCR3 pgmPoolCacheUsed calls.
-    if (pPool->aPages[iToFree].iUserHead != NIL_PGMPOOL_USER_INDEX)
-    {
-        uint16_t i = pPool->aPages[iToFree].iAgePrev;
-        for (unsigned j = 0; j < 10 && i != NIL_PGMPOOL_USER_INDEX; j++, i = pPool->aPages[i].iAgePrev)
-        {
-            if (pPool->aPages[iToFree].iUserHead == NIL_PGMPOOL_USER_INDEX)
-                continue;
-            iToFree = i;
+        if (pPool->aPages[iToFree].iUserHead != NIL_PGMPOOL_USER_INDEX)
+        {
+            uint16_t i = pPool->aPages[iToFree].iAgePrev;
+            for (unsigned j = 0; j < 10 && i != NIL_PGMPOOL_USER_INDEX; j++, i = pPool->aPages[i].iAgePrev)
+            {
+                if (pPool->aPages[iToFree].iUserHead == NIL_PGMPOOL_USER_INDEX)
+                    continue;
+                iToFree = i;
+                break;
+            }
+        }
+*/
+        Assert(iToFree != iUser);
+        AssertRelease(iToFree != NIL_PGMPOOL_IDX);
+        pPage = &pPool->aPages[iToFree];
+
+        /*
+         * Reject any attempts at flushing the currently active shadow CR3 mapping.
+         * Call pgmPoolCacheUsed to move the page to the head of the age list.
+         */
+        if (!pgmPoolIsPageLocked(&pPool->CTX_SUFF(pVM)->pgm.s, pPage))
             break;
-        }
-    }
-*/
-
-    Assert(iToFree != iUser);
-    AssertRelease(iToFree != NIL_PGMPOOL_IDX);
-
-    PPGMPOOLPAGE pPage = &pPool->aPages[iToFree];
-
-    /*
-     * Reject any attempts at flushing the currently active shadow CR3 mapping
-     */
-    if (pgmPoolIsPageLocked(&pPool->CTX_SUFF(pVM)->pgm.s, pPage))
-    {
-        /* Refresh the cr3 mapping by putting it at the head of the age list. */
-        LogFlow(("pgmPoolCacheFreeOne refuse CR3 mapping\n"));
+        LogFlow(("pgmPoolCacheFreeOne: refuse CR3 mapping\n"));
         pgmPoolCacheUsed(pPool, pPage);
-        return pgmPoolCacheFreeOne(pPool, iUser);
-    }
-
+        AssertLogRelReturn(iLoop < 8192, VERR_INTERNAL_ERROR);
+    }
+
+    /*
+     * Found a usable page, flush it and return.
+     */
     int rc = pgmPoolFlushPage(pPool, pPage);
     if (rc == VINF_SUCCESS)