lkml.org 
[lkml]   [2017]   [Dec]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] KVM/Eventfd: Avoid crash when assign and deassign same eventfd in parallel.
From
Date
On 2017年12月18日 16:50, Paolo Bonzini wrote:
> On 18/12/2017 09:30, David Hildenbrand wrote:
>> The ugly thing in kvm_irqfd_assign() is that we access irqfd without
>> holding a lock. I think that should rather be fixed than working around
>> that issue. (e.g. lock() -> lookup again -> verify still in list ->
>> unlock())
>
> I wonder if it's even simpler:
>
> diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c
> index f2ac53ab8243..17ed298bd66f 100644
> --- a/virt/kvm/eventfd.c
> +++ b/virt/kvm/eventfd.c
> @@ -387,7 +387,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
>
> idx = srcu_read_lock(&kvm->irq_srcu);
> irqfd_update(kvm, irqfd);
> - srcu_read_unlock(&kvm->irq_srcu, idx);
>
> list_add_tail(&irqfd->list, &kvm->irqfds.items);
>
> @@ -420,10 +419,12 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args)
> irqfd->consumer.token, ret);
> }
> #endif
> + srcu_read_unlock(&kvm->irq_srcu, idx);
>
> return 0;
>
> fail:
> + /* irq_srcu is *not* held here. */
> if (irqfd->resampler)
> irqfd_resampler_shutdown(irqfd);
>
>

Hi Paolo:
This patch still can't prevent from freeing struct irqfd in
irq_shutdown() during assign irqfd. Once irqfd is added to
kvm->irqfds.items list, deassign path can get irqfd and free it.
--
Best regards
Tianyu Lan

\
 
 \ /
  Last update: 2017-12-19 07:46    [W:0.566 / U:4.660 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site