diff mbox

kvm-kmod: fix kvm_request_irq race

Message ID 20090521062135.GR20823@sequoia.sous-sol.org (mailing list archive)
State New, archived
Headers show

Commit Message

Chris Wright May 21, 2009, 6:21 a.m. UTC
Commit "32658734: Fix request_irq() for < 2.6.19" is racy between multiple
guests since ioctl is only serialized per guest.  Add mutex and serialize
kvm_request_irq/kvm_free_irq to avoid race.

Signed-off-by: Chris Wright <chrisw@redhat.com>
---
 external-module-compat-comm.h |   14 +++++++++++---
 1 files changed, 11 insertions(+), 3 deletions(-)

--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Avi Kivity May 21, 2009, 6:29 a.m. UTC | #1
Chris Wright wrote:
> Commit "32658734: Fix request_irq() for < 2.6.19" is racy between multiple
> guests since ioctl is only serialized per guest.  Add mutex and serialize
> kvm_request_irq/kvm_free_irq to avoid race.
>
> Signed-off-by: Chris Wright <chrisw@redhat.com>
> ---
>  external-module-compat-comm.h |   14 +++++++++++---
>  1 files changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/external-module-compat-comm.h b/external-module-compat-comm.h
> index 8cb5440..eaad986 100644
> --- a/external-module-compat-comm.h
> +++ b/external-module-compat-comm.h
> @@ -645,6 +645,7 @@ static inline int pci_reset_function(struct pci_dev *dev)
>  
>  typedef irqreturn_t (*kvm_irq_handler_t)(int, void *);
>  static kvm_irq_handler_t kvm_irq_handlers[NR_IRQS];
> +static DEFINE_MUTEX(kvm_irq_handlers_mutex);
>  
>   

Since this mutex is in a header file, it can be instantiated multiple 
times.  It will only serialize callers within a translation unit.  
Please define it in a C file.

Would be best to move the the code as well.
Chris Wright May 21, 2009, 6:38 a.m. UTC | #2
* Avi Kivity (avi@redhat.com) wrote:
> Since this mutex is in a header file, it can be instantiated multiple  
> times.  It will only serialize callers within a translation unit.   
> Please define it in a C file.
>
> Would be best to move the the code as well.

Yeah it seems to get linked multiple times (when I tried that I found
duplicates).  I'll look again.

thanks,
-chris
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/external-module-compat-comm.h b/external-module-compat-comm.h
index 8cb5440..eaad986 100644
--- a/external-module-compat-comm.h
+++ b/external-module-compat-comm.h
@@ -645,6 +645,7 @@  static inline int pci_reset_function(struct pci_dev *dev)
 
 typedef irqreturn_t (*kvm_irq_handler_t)(int, void *);
 static kvm_irq_handler_t kvm_irq_handlers[NR_IRQS];
+static DEFINE_MUTEX(kvm_irq_handlers_mutex);
 
 static irqreturn_t kvm_irq_thunk(int irq, void *dev_id, struct pt_regs *regs)
 {
@@ -655,21 +656,28 @@  static irqreturn_t kvm_irq_thunk(int irq, void *dev_id, struct pt_regs *regs)
 static inline int kvm_request_irq(unsigned int a, kvm_irq_handler_t handler,
 				  unsigned long c, const char *d, void *e)
 {
-	int rc;
-	kvm_irq_handler_t old = kvm_irq_handlers[a];
+	int rc = -EBUSY;
+	kvm_irq_handler_t old;
+
+	mutex_lock(&kvm_irq_handlers_mutex);
+	old = kvm_irq_handlers[a];
 	if (old)
-		return -EBUSY;
+		goto out;
 	kvm_irq_handlers[a] = handler;
 	rc = request_irq(a, kvm_irq_thunk, c, d, e);
 	if (rc)
 		kvm_irq_handlers[a] = NULL;
+out:
+	mutex_unlock(&kvm_irq_handlers_mutex);
 	return rc;
 }
 
 static inline void kvm_free_irq(unsigned int irq, void *dev_id)
 {
+	mutex_lock(&kvm_irq_handlers_mutex);
 	free_irq(irq, dev_id);
 	kvm_irq_handlers[irq] = NULL;
+	mutex_unlock(&kvm_irq_handlers_mutex);
 }
 
 #else