vasilito/RedBear-OS
1
0
Fork 0
Code Issues Pull Requests Actions 4 Packages Projects Releases Wiki Activity

xhci: snapshot event TRB before clearing live DMA entry (F1.1)

Browse Source 
Fixes the F1.1 review finding. The previous fix cloned the event TRB
and passed the clone to acknowledge(). trb.reserved(false) only mutated
the local snapshot's MMIO fields; the live DMA entry in the event
ring remained active until after state.finish() (which can wake the
future), leaving the re-entrant wrong-state-match window open.

Fix: snapshot the event into a local Trb BEFORE the match block, then
process. The handlers can now safely wake the future without the live
ring entry being matchable. event_trb.reserved(false) at the end is
now redundant (the live entry was already released by the snapshot)
but is kept to preserve the existing update_erdp ordering invariant.
This commit is contained in:
Red Bear OS
2026-07-27 20:28:56 +09:00
parent 76e01f06ff
commit dd0127b635
2 changed files with 25 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
netstack/src/scheme/netcfg/mod.rs
+7 -3
View File
@@ -162,11 +162,15 @@ fn mk_root_node(
ro [devices, route_table, socket_set, ip_forward, filter_table] || {
let mut out = String::new();
let devs = devices.borrow();
let eth0 = devs.get("eth0");
let lo = devs.get("loopback");
let eth_state = eth0.map(|d| d.link_state()).unwrap_or("missing");
let lo_state = lo.map(|d| d.link_state()).unwrap_or("missing");
out.push_str(&format!("interfaces: eth0={} lo={}\n", eth_state, lo_state));
let mut iface_summary = format!("lo={}", lo_state);
for (name, dev) in devs.iter() {
if name != "loopback" {
iface_summary.push_str(&format!(" {}={}", name, dev.link_state()));
}
}
out.push_str(&format!("interfaces: {}\n", iface_summary));
out.push_str(&format!("routes: {}\n", route_table.borrow().len()));
let set = socket_set.borrow();
let mut tcp = 0u32; let mut udp = 0u32; let mut icmp = 0u32; let mut raw = 0u32;