[RFC XENCONS PATCH] Call EvtchnUnmask within the BlkifRing lock

["Tu Dinh" <ngoc-tu.dinh@xxxxxxxxxx>]

The call to EvtchnUnmask accesses Channel outside of the ring lock.
Therefore, it can access a stale channel if the DPC is still running
after the channel has been closed in RingDisconnect. Since
RingDisconnect runs at DISPATCH_LEVEL, we cannot use KeFlushQueuedDpcs
and have to guard against the event channel's closure via the Enabled
flag instead.

Ported from XenVbd.
---
 src/xencons/ring.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/src/xencons/ring.c b/src/xencons/ring.c
index afa9311..61c082b 100644
--- a/src/xencons/ring.c
+++ b/src/xencons/ring.c
@@ -567,30 +567,30 @@ RingDpc(
     ASSERT(Ring != NULL);
 
     for (;;) {
-        BOOLEAN Enabled;
         BOOLEAN Retry;
         KIRQL   Irql;
 
         KeAcquireSpinLock(&Ring->Lock, &Irql);
-        Enabled = Ring->Enabled;
-        KeReleaseSpinLock(&Ring->Lock, Irql);
 
-        if (!Enabled)
-            break;
+        if (Ring->Enabled) {
+            Retry = RingPoll(Ring);
+
+            if (!Retry) {
+                (VOID) XENBUS_EVTCHN(Unmask,
+                                     &Ring->EvtchnInterface,
+                                     Ring->Channel,
+                                     FALSE,
+                                     FALSE);
+            }
+        } else {
+            Retry = FALSE;
+        }
 
-        KeRaiseIrql(DISPATCH_LEVEL, &Irql);
-        Retry = RingPoll(Ring);
-        KeLowerIrql(Irql);
+        KeReleaseSpinLock(&Ring->Lock, Irql);
 
         if (!Retry)
             break;
     }
-
-    (VOID) XENBUS_EVTCHN(Unmask,
-                         &Ring->EvtchnInterface,
-                         Ring->Channel,
-                         FALSE,
-                         FALSE);
 }
 
 _Function_class_(KSERVICE_ROUTINE)
-- 
2.53.0.windows.2



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech