[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 135/156] aio: fix qemu_bh_schedule() bh->ctx race co
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 135/156] aio: fix qemu_bh_schedule() bh->ctx race condition |
Date: |
Tue, 8 Jul 2014 12:18:46 -0500 |
From: Stefan Hajnoczi <address@hidden>
qemu_bh_schedule() is supposed to be thread-safe at least the first time
it is called. Unfortunately this is not quite true:
bh->scheduled = 1;
aio_notify(bh->ctx);
Since another thread may run the BH callback once it has been scheduled,
there is a race condition if the callback frees the BH before
aio_notify(bh->ctx) has a chance to run.
Reported-by: Stefan Priebe <address@hidden>
Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Paolo Bonzini <address@hidden>
Tested-by: Stefan Priebe <address@hidden>
(cherry picked from commit 924fe1293c3e7a3c787bbdfb351e7f168caee3e9)
Signed-off-by: Michael Roth <address@hidden>
---
async.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/async.c b/async.c
index 5fb3fa6..c6d810d 100644
--- a/async.c
+++ b/async.c
@@ -117,15 +117,21 @@ void qemu_bh_schedule_idle(QEMUBH *bh)
void qemu_bh_schedule(QEMUBH *bh)
{
+ AioContext *ctx;
+
if (bh->scheduled)
return;
+ ctx = bh->ctx;
bh->idle = 0;
- /* Make sure that idle & any writes needed by the callback are done
- * before the locations are read in the aio_bh_poll.
+ /* Make sure that:
+ * 1. idle & any writes needed by the callback are done before the
+ * locations are read in the aio_bh_poll.
+ * 2. ctx is loaded before scheduled is set and the callback has a chance
+ * to execute.
*/
- smp_wmb();
+ smp_mb();
bh->scheduled = 1;
- aio_notify(bh->ctx);
+ aio_notify(ctx);
}
--
1.9.1
- [Qemu-devel] [PATCH 122/156] target-xtensa: fix cross-page jumps/calls at the end of TB, (continued)
- [Qemu-devel] [PATCH 122/156] target-xtensa: fix cross-page jumps/calls at the end of TB, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 123/156] cputlb: Fix regression with TCG interpreter (bug 1310324), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 126/156] block/qapi: Plug memory leak in dump_qobject() case QTYPE_QERROR, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 129/156] block/sheepdog: Plug memory leak in sd_snapshot_create(), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 127/156] block/vvfat: Plug memory leak in check_directory_consistency(), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 125/156] blockdev: Plug memory leak in drive_init(), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 128/156] block/vvfat: Plug memory leak in read_directory(), Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 130/156] qemu-img: Plug memory leak in convert command, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 133/156] target-arm: Fix errors in writes to generic timer control registers, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 131/156] linux-user: Don't overrun guest buffer in sched_getaffinity, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 135/156] aio: fix qemu_bh_schedule() bh->ctx race condition,
Michael Roth <=
- [Qemu-devel] [PATCH 132/156] tcg-i386: Fix win64 qemu store, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 134/156] s390x/css: handle emw correctly for tsch, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 137/156] kvmclock: Ensure proper env->tsc value for kvmclock_current_nsec calculation, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 136/156] kvmclock: Ensure time in migration never goes backward, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 142/156] usb: Fix usb-bt-dongle initialization., Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 141/156] vhost: fix resource leak in error handling, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 145/156] target-i386: Filter FEAT_7_0_EBX TCG features too, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 139/156] rdma: bug fixes, Michael Roth, 2014/07/08
- [Qemu-devel] [PATCH 096/156] qcow2: Don't rely on free_cluster_index in alloc_refcount_block() (CVE-2014-0147), Michael Roth, 2014/07/08