提交 6bbfb265 编写于 作者: M Michael S. Tsirkin 提交者: Marcelo Tosatti

KVM: fix irqfd assign/deassign race

I think I see the following (theoretical) race:

During irqfd assign, we drop irqfds lock before we
schedule inject work. Therefore, deassign running
on another CPU could cause shutdown and flush to run
before inject, causing user after free in inject.

A simple fix it to schedule inject under the lock.
Signed-off-by: NMichael S. Tsirkin <mst@redhat.com>
Acked-by: NGregory Haskins <ghaskins@novell.com>
Signed-off-by: NMarcelo Tosatti <mtosatti@redhat.com>
上级 c79bd892
...@@ -218,7 +218,6 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi) ...@@ -218,7 +218,6 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
events = file->f_op->poll(file, &irqfd->pt); events = file->f_op->poll(file, &irqfd->pt);
list_add_tail(&irqfd->list, &kvm->irqfds.items); list_add_tail(&irqfd->list, &kvm->irqfds.items);
spin_unlock_irq(&kvm->irqfds.lock);
/* /*
* Check if there was an event already pending on the eventfd * Check if there was an event already pending on the eventfd
...@@ -227,6 +226,8 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi) ...@@ -227,6 +226,8 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
if (events & POLLIN) if (events & POLLIN)
schedule_work(&irqfd->inject); schedule_work(&irqfd->inject);
spin_unlock_irq(&kvm->irqfds.lock);
/* /*
* do not drop the file until the irqfd is fully initialized, otherwise * do not drop the file until the irqfd is fully initialized, otherwise
* we might race against the POLLHUP * we might race against the POLLHUP
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册