Re: [PATCH] Check Fragment is non-null

[Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>]

On 22/04/2026 11:30, Owen Smith wrote:
> When processing a response, the id value should indicate the index into
> the Pending array, of the relevant Fragment. In some situations, its
> possible that the Pending array entry has already been NULLed, likely
> due to a backend inserted response coinciding with a frontend faked
> response. If the Fragment returned from the Pending array is NULL, then
> any attempt to access this NULL Fragment will result in a bugcheck.
> Skip any responses where the related Pending entry has already been NULLed.
> 
> Signed-off-by: Owen Smith <owen.smith@xxxxxxxxxx>

Reviewed-by: Tu Dinh <ngoc-tu.dinh@xxxxxxxxxx>

Thanks,

NB: IMO while we're not faking receiver responses, we may eventually 
need a similar adjustment in ReceiverRingPoll and some other places 
given that a backend can give out bogus IDs.

> ---
>   src/xenvif/transmitter.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/src/xenvif/transmitter.c b/src/xenvif/transmitter.c
> index 0f7deb1..58f8575 100644
> --- a/src/xenvif/transmitter.c
> +++ b/src/xenvif/transmitter.c
> @@ -2525,7 +2525,9 @@ TransmitterRingPoll(
>               Fragment = Ring->Pending[id];
>               Ring->Pending[id] = NULL;
>   
> -            ASSERT(Fragment != NULL);
> +            if (Fragment == NULL)
> +                continue;
> +
>               ASSERT3U(Fragment->Id, ==, id);
>   
>               switch (Fragment->Type) {



--
Ngoc Tu Dinh | Vates XCP-ng Developer

XCP-ng & Xen Orchestra - Vates solutions

web: https://vates.tech