Fix BSOD on RingDestroy

Zero Frontend->MaxQueues after calling RingDestroy, as RingDestroy will
query this value to free each BlkifRing, which will decrement an
unsigned value below 0.
Also adds an ASSERT to detect if FrontendGetMaxQueues returns 0.

Signed-off-by: Owen Smith <owen.smith@citrix.com>
Test that Index != 0 rather than > 0, since it is an unsigned quantity.

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>

diff --git a/src/xenvbd/frontend.c b/src/xenvbd/frontend.c
index 987d2377538ece5423c0a13fe8dc7bcc2103c8e8..b12e122d2f8f1946271d12b4e561acedaca746bd 100644 (file)
--- a/src/xenvbd/frontend.c
+++ b/src/xenvbd/frontend.c
@@ -1976,8 +1976,6 @@ FrontendDestroy(
     Frontend->Page83.Data = NULL;
     Frontend->Page83.Size = 0;
 
-    Frontend->MaxQueues = 0;
-
     ThreadAlert(Frontend->BackendThread);
     ThreadJoin(Frontend->BackendThread);
     Frontend->BackendThread = NULL;
@@ -1988,6 +1986,8 @@ FrontendDestroy(
     RingDestroy(Frontend->Ring);
     Frontend->Ring = NULL;
 
+    Frontend->MaxQueues = 0;
+
     ASSERT3P(Frontend->BackendPath, ==, NULL);
     ASSERT3P(Frontend->BackendWatch, ==, NULL);
 

diff --git a/src/xenvbd/ring.c b/src/xenvbd/ring.c
index d59522623c304b60b9082253d6c11fa695abdc23..cd5b5707d30625df4b03b5869519bf8dd202aa41 100644 (file)
--- a/src/xenvbd/ring.c
+++ b/src/xenvbd/ring.c
@@ -2338,8 +2338,9 @@ RingDestroy(
     ULONG               Index;
 
     Index = FrontendGetMaxQueues(Ring->Frontend);
+    ASSERT3U(Index, !=, 0);
 
-    while (--Index > 0) {
+    while (--Index != 0) {
         PXENVBD_BLKIF_RING  BlkifRing = Ring->Ring[Index];
 
         Ring->Ring[Index] = NULL;