From: Paul Durrant <paul.durrant@citrix.com>
Date: Tue, 19 Jan 2016 11:21:28 +0000 (+0000)
Subject: Make transmitter robust against a possible completion race
X-Git-Tag: 8.1.0-rc10~5
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=7c3365d5;p=pvdrivers%2Fwin%2Fxennet.git

Make transmitter robust against a possible completion race

It's possible that a transmission invoked on one CPU may complete on another
before the transmission invocation as finished. Therefore, once we have queued
a NET_BUFFER for transmission we should not use it's metadata again (including
the 'next' pointer).

Signed-off-by: Paul Durrant <paul.durrant@citrix.com>
---

diff --git a/src/xennet/receiver.c b/src/xennet/receiver.c
index 955b2b2..6ce8289 100644
--- a/src/xennet/receiver.c
+++ b/src/xennet/receiver.c
@@ -90,6 +90,8 @@ __ReceiverAllocateNetBufferList(
         NET_BUFFER_DATA_OFFSET(NetBuffer) = Offset;
         NET_BUFFER_DATA_LENGTH(NetBuffer) = Length;
         NET_BUFFER_CURRENT_MDL_OFFSET(NetBuffer) = Offset;
+
+        ASSERT3P(NET_BUFFER_NEXT_NB(NetBuffer), ==, NULL);
     } else {
         NetBufferList = NdisAllocateNetBufferAndNetBufferList(Receiver->NetBufferListPool,
                                                               0,
diff --git a/src/xennet/transmitter.c b/src/xennet/transmitter.c
index b5e110a..91ed5f2 100644
--- a/src/xennet/transmitter.c
+++ b/src/xennet/transmitter.c
@@ -250,11 +250,12 @@ TransmitterSendNetBufferLists(
 
         NetBuffer = NET_BUFFER_LIST_FIRST_NB(NetBufferList);
         while (NetBuffer != NULL) {
+            PNET_BUFFER         NetBufferListNext = NET_BUFFER_NEXT_NB(NetBuffer);
             PVOID               Cookie = NetBufferList;
             XENVIF_PACKET_HASH  Hash;
             NTSTATUS            status;
 
-            ListReserved->Reference++;
+            InterlockedIncrement(&ListReserved->Reference);
 
             Hash.Algorithm = XENVIF_PACKET_HASH_ALGORITHM_NONE;
 
@@ -274,7 +275,7 @@ TransmitterSendNetBufferLists(
                 break;
             }
 
-            NetBuffer = NET_BUFFER_NEXT_NB(NetBuffer);
+            NetBuffer = NetBufferListNext;
         }
 
         NetBufferList = ListNext;