儲存庫 vbox 的更動 65888

時間撮記:

2017-2-27 下午02:58:49 (8 年 以前)

作者:

vboxsync

訊息:

DrvVD: Prevent recursion in drvvdMediaExIoReqBufFree() when freeing request memory of canceled requests waiting for memory. Instead, free the memory immediately when the request got canceled to give other requests a chance to allocate the memory

檔案:

• trunk/src/VBox/Devices/Storage/DrvVD.cpp (修改) (4 筆差異)

trunk/src/VBox/Devices/Storage/DrvVD.cpp

@@ -3306 +3306 @@
     if (   (   pIoReq->enmType == PDMMEDIAEXIOREQTYPE_READ
             || pIoReq->enmType == PDMMEDIAEXIOREQTYPE_WRITE)
-        && !pIoReq->ReadWrite.fDirectBuf)
+        && !pIoReq->ReadWrite.fDirectBuf
+        && pIoReq->ReadWrite.cbIoBuf > 0)
     {
         IOBUFMgrFreeBuf(&pIoReq->ReadWrite.IoBuf);
@@ -3314 +3315 @@
         {
             RTLISTANCHOR LstIoReqProcess;
+            RTLISTANCHOR LstIoReqCanceled;
             RTListInit(&LstIoReqProcess);
+            RTListInit(&LstIoReqCanceled);
 
             /* Try to process as many requests as possible. */
@@ -3338 +3341 @@
                     pIoReqCur->ReadWrite.pSgBuf     = &pIoReqCur->ReadWrite.IoBuf.SgBuf;
 
-                    RTListAppend(&LstIoReqProcess, &pIoReqCur->NdLstWait);
+                    bool fXchg = ASMAtomicCmpXchgU32((volatile uint32_t *)&pIoReqCur->enmState,
+                                                     VDIOREQSTATE_ACTIVE, VDIOREQSTATE_ALLOCATED);
+                    if (RT_UNLIKELY(!fXchg))
+                    {
+                        /* Must have been canceled inbetween. */
+                        Assert(pIoReqCur->enmState == VDIOREQSTATE_CANCELED);
+
+                        /* Free the buffer here already again to let other requests get a chance to allocate the memory. */
+                        IOBUFMgrFreeBuf(&pIoReq->ReadWrite.IoBuf);
+                        pIoReqCur->ReadWrite.cbIoBuf = 0;
+                        RTListAppend(&LstIoReqCanceled, &pIoReqCur->NdLstWait);
+                    }
+                    else
+                    {
+                        ASMAtomicIncU32(&pThis->cIoReqsActive);
+                        RTListAppend(&LstIoReqProcess, &pIoReqCur->NdLstWait);
+                    }
                 }
                 else
@@ -3350 +3369 @@
             ASMAtomicAddU32(&pThis->cIoReqsWaiting, cIoReqsWaiting);
 
-            /* Process the requests we could allocate memory for outside the lock now. */
+            /* Process the requests we could allocate memory for and the ones which got canceled outside the lock now. */
+            RTListForEachSafe(&LstIoReqCanceled, pIoReqCur, pIoReqNext, PDMMEDIAEXIOREQINT, NdLstWait)
+            {
+                RTListNodeRemove(&pIoReqCur->NdLstWait);
+                drvvdMediaExIoReqCompleteWorker(pThis, pIoReqCur, VERR_PDM_MEDIAEX_IOREQ_CANCELED, true /* fUpNotify */);
+            }
+
             RTListForEachSafe(&LstIoReqProcess, pIoReqCur, pIoReqNext, PDMMEDIAEXIOREQINT, NdLstWait)
             {
                 RTListNodeRemove(&pIoReqCur->NdLstWait);
-
-                bool fXchg = ASMAtomicCmpXchgU32((volatile uint32_t *)&pIoReqCur->enmState, VDIOREQSTATE_ACTIVE, VDIOREQSTATE_ALLOCATED);
-                if (RT_UNLIKELY(!fXchg))
-                {
-                    /* Must have been canceled inbetween. */
-                    Assert(pIoReqCur->enmState == VDIOREQSTATE_CANCELED);
-                    drvvdMediaExIoReqCompleteWorker(pThis, pIoReqCur, VERR_PDM_MEDIAEX_IOREQ_CANCELED, true /* fUpNotify */);
-                }
-                ASMAtomicIncU32(&pThis->cIoReqsActive);
                 drvvdMediaExIoReqReadWriteProcess(pThis, pIoReqCur, true /* fUpNotify */);
             }