Re: [PATCH] Prevent NULL MDL's from being queued for transmission.

[Paul Durrant <xadimgnik@xxxxxxxxx>]

On 28/07/2021 15:02, Martin Harvey wrote:
> Under conditions of high load and low resources, it was
> possible for NDIS (in combination with overlying drivers) to send
> NET_BUFFER_LIST structures containing NULL MDL's for transmission.
> This resulted in an immediate bugcheck.
>
> This patch prevents NULL MDL's from being sent to XenVif.
>
> Signed-off-by: Martin Harvey <martin.harvey@xxxxxxxxxx>
Acked-by: Paul Durrant <paul@xxxxxxx>

> ---
>   src/xennet/transmitter.c | 26 +++++++++++++++-----------
>   1 file changed, 15 insertions(+), 11 deletions(-)
>
> diff --git a/src/xennet/transmitter.c b/src/xennet/transmitter.c
> index 0e184fd..334bbb9 100644
> --- a/src/xennet/transmitter.c
> +++ b/src/xennet/transmitter.c
> @@ -323,17 +323,21 @@ __TransmitterSendNetBufferList(
>   
>           __TransmitterGetNetBufferList(Transmitter, NetBufferList);
>   
> -        status = XENVIF_VIF(TransmitterQueuePacket,
> -                            AdapterGetVifInterface(Transmitter->Adapter),
> -                            NET_BUFFER_CURRENT_MDL(NetBuffer),
> -                            NET_BUFFER_CURRENT_MDL_OFFSET(NetBuffer),
> -                            NET_BUFFER_DATA_LENGTH(NetBuffer),
> -                            OffloadOptions,
> -                            MaximumSegmentSize,
> -                            TagControlInformation,
> -                            &Hash,
> -                            (NetBufferListNext != NULL) ? TRUE : FALSE,
> -                            Cookie);
> +        if (NET_BUFFER_CURRENT_MDL(NetBuffer) != NULL) {
> +            status = XENVIF_VIF(TransmitterQueuePacket,
> +                                AdapterGetVifInterface(Transmitter->Adapter),
> +                                NET_BUFFER_CURRENT_MDL(NetBuffer),
> +                                NET_BUFFER_CURRENT_MDL_OFFSET(NetBuffer),
> +                                NET_BUFFER_DATA_LENGTH(NetBuffer),
> +                                OffloadOptions,
> +                                MaximumSegmentSize,
> +                                TagControlInformation,
> +                                &Hash,
> +                                (NetBufferListNext != NULL) ? TRUE : FALSE,
> +                                Cookie);
> +        }
> +        else
> +            status = STATUS_INVALID_PARAMETER;
>           if (!NT_SUCCESS(status)) {
>               __TransmitterReturnPacket(Transmitter, Cookie,
>                                         NDIS_STATUS_NOT_ACCEPTED);