win-pvdrivers

changeset 90:93879f914f05

fix shutdown memory leaks caught by driver verifier
author Andy Grover <andy.grover@oracle.com>
date Wed Jan 02 15:47:16 2008 -0800 (2008-01-02)
parents 5f69bcb9090c
children 24963c2b7846
files xennet/xennet.c xenpci/xenpci.c
line diff
     1.1 --- a/xennet/xennet.c	Wed Jan 02 14:10:35 2008 -0800
     1.2 +++ b/xennet/xennet.c	Wed Jan 02 15:47:16 2008 -0800
     1.3 @@ -606,6 +606,7 @@ XenNet_Init(
     1.4    struct xennet_info *xi = NULL;
     1.5    ULONG length;
     1.6    WDF_OBJECT_ATTRIBUTES wdf_attrs;
     1.7 +  char *res;
     1.8    char *Value;
     1.9    char TmpPath[128];
    1.10  
    1.11 @@ -721,15 +722,15 @@ XenNet_Init(
    1.12    RtlStringCbPrintfA(TmpPath, ARRAY_SIZE(TmpPath),
    1.13        "%s/backend", xi->pdoData->Path);
    1.14    KdPrint(("About to read %s to get backend path\n", TmpPath));
    1.15 -  xi->XenInterface.XenBus_Read(xi->XenInterface.InterfaceHeader.Context,
    1.16 +  res = xi->XenInterface.XenBus_Read(xi->XenInterface.InterfaceHeader.Context,
    1.17        XBT_NIL, TmpPath, &Value);
    1.18 -  if (!Value)
    1.19 +  if (res)
    1.20    {
    1.21      KdPrint((__DRIVER_NAME "    Failed to read backend path\n"));
    1.22 +    xi->XenInterface.FreeMem(res);
    1.23      status = NDIS_STATUS_FAILURE;
    1.24      goto err;
    1.25    }
    1.26 -  // Check for Value == NULL here
    1.27    RtlStringCbCopyA(xi->BackendPath, ARRAY_SIZE(xi->BackendPath), Value);
    1.28    KdPrint((__DRIVER_NAME "backend path = %s\n", xi->BackendPath));
    1.29  
     2.1 --- a/xenpci/xenpci.c	Wed Jan 02 14:10:35 2008 -0800
     2.2 +++ b/xenpci/xenpci.c	Wed Jan 02 15:47:16 2008 -0800
     2.3 @@ -252,6 +252,16 @@ get_hypercall_stubs(WDFDEVICE Device)
     2.4    return STATUS_SUCCESS;
     2.5  }
     2.6  
     2.7 +static NTSTATUS
     2.8 +free_hypercall_stubs(WDFDEVICE Device)
     2.9 +{
    2.10 +  PXENPCI_DEVICE_DATA xpdd = GetDeviceData(Device);
    2.11 +
    2.12 +  ExFreePoolWithTag(xpdd->hypercall_stubs, XENPCI_POOL_TAG);
    2.13 +
    2.14 +  return STATUS_SUCCESS;
    2.15 +}
    2.16 +
    2.17  /*
    2.18   * Alloc MMIO from the device's MMIO region. There is no corresponding free() fn
    2.19   */
    2.20 @@ -547,9 +557,10 @@ XenPCI_PrepareHardware(
    2.21  static NTSTATUS
    2.22  XenPCI_ReleaseHardware(WDFDEVICE Device, WDFCMRESLIST ResourcesTranslated)
    2.23  {
    2.24 -  UNREFERENCED_PARAMETER(Device);
    2.25    UNREFERENCED_PARAMETER(ResourcesTranslated);
    2.26  
    2.27 +  free_hypercall_stubs(Device);
    2.28 +
    2.29    return STATUS_SUCCESS;
    2.30  }
    2.31  
    2.32 @@ -611,6 +622,8 @@ XenPCI_D0EntryPostInterruptsEnabled(WDFD
    2.33    }
    2.34    KdPrint((__DRIVER_NAME " <-- EvtDeviceD0EntryPostInterruptsEnabled\n"));
    2.35  
    2.36 +  XenPCI_FreeMem(Types);
    2.37 +
    2.38    return status;
    2.39  }
    2.40  
    2.41 @@ -928,7 +941,8 @@ XenPCI_XenBusWatchHandler(char *Path, PV
    2.42  static void
    2.43  XenBus_ShutdownHandler(char *Path, PVOID Data)
    2.44  {
    2.45 -  WDFDEVICE Device = Data;
    2.46 +  WDFDEVICE Device = Data;  
    2.47 +  char *res;
    2.48    char *Value;
    2.49    xenbus_transaction_t xbt;
    2.50    int retry;
    2.51 @@ -938,12 +952,34 @@ XenBus_ShutdownHandler(char *Path, PVOID
    2.52  
    2.53    KdPrint((__DRIVER_NAME " --> XenBus_ShutdownHandler\n"));
    2.54  
    2.55 -  XenBus_StartTransaction(Device, &xbt);
    2.56 +  res = XenBus_StartTransaction(Device, &xbt);
    2.57 +  if (res)
    2.58 +  {
    2.59 +    KdPrint(("Error starting transaction\n"));
    2.60 +    XenPCI_FreeMem(res);
    2.61 +    return;
    2.62 +  }
    2.63  
    2.64 -  XenBus_Read(Device, XBT_NIL, SHUTDOWN_PATH, &Value);
    2.65 +  res = XenBus_Read(Device, XBT_NIL, SHUTDOWN_PATH, &Value);
    2.66 +  if (res)
    2.67 +  {
    2.68 +    KdPrint(("Error reading shutdown path\n"));
    2.69 +    XenPCI_FreeMem(res);
    2.70 +    XenBus_EndTransaction(Device, xbt, 1, &retry);
    2.71 +    return;
    2.72 +  }
    2.73  
    2.74    if (Value != NULL && strlen(Value) != 0)
    2.75 -    XenBus_Write(Device, XBT_NIL, SHUTDOWN_PATH, "");
    2.76 +  {
    2.77 +    res = XenBus_Write(Device, XBT_NIL, SHUTDOWN_PATH, "");
    2.78 +    if (res)
    2.79 +    {
    2.80 +      KdPrint(("Error writing shutdown path\n"));
    2.81 +      XenPCI_FreeMem(res);
    2.82 +      // end trans?
    2.83 +      return;
    2.84 +    }
    2.85 +  } 
    2.86  
    2.87    if (Value != NULL)
    2.88    {
    2.89 @@ -955,7 +991,13 @@ XenBus_ShutdownHandler(char *Path, PVOID
    2.90      KdPrint((__DRIVER_NAME "     Shutdown Value = <null>\n"));
    2.91    }
    2.92  
    2.93 -  XenBus_EndTransaction(Device, xbt, 0, &retry);
    2.94 +  res = XenBus_EndTransaction(Device, xbt, 0, &retry);
    2.95 +  if (res)
    2.96 +  {
    2.97 +    KdPrint(("Error ending transaction\n"));
    2.98 +    XenPCI_FreeMem(res);
    2.99 +    return;
   2.100 +  }
   2.101  
   2.102    if (Value != NULL && strlen(Value) != 0)
   2.103    {
   2.104 @@ -965,6 +1007,9 @@ XenBus_ShutdownHandler(char *Path, PVOID
   2.105      InsertTailList(&ShutdownMsgList, &Entry->ListEntry);
   2.106      WdfIoQueueStart(ReadQueue);
   2.107    }
   2.108 +
   2.109 +  XenPCI_FreeMem(Value);
   2.110 +
   2.111    KdPrint((__DRIVER_NAME " <-- XenBus_ShutdownHandler\n"));
   2.112  }
   2.113  
   2.114 @@ -990,7 +1035,9 @@ XenBus_BalloonHandler(char *Path, PVOID 
   2.115    // use XENMEM_increase_reservation and XENMEM_decrease_reservation
   2.116  
   2.117    XenBus_EndTransaction(Device, xbt, 0, &retry);
   2.118 -  
   2.119 +
   2.120 +  XenPCI_FreeMem(value);
   2.121 +
   2.122    KdPrint((__DRIVER_NAME " <-- XenBus_BalloonHandler\n"));
   2.123  }
   2.124