Message ID | 1437391637-31576-1-git-send-email-peter.maydell@linaro.org |
---|---|
State | New |
Headers | show |
On 20/07/2015 13:27, Peter Maydell wrote: > When accessing the dispatch pointer in an AddressSpace within an RCU > critical section we should always use atomic_rcu_read(). Fix an > access within memory_region_section_get_iotlb() which was incorrectly > doing a direct pointer access. > > Signed-off-by: Peter Maydell <peter.maydell@linaro.org> > --- > I discussed this on IRC with Paolo a while back, and IIRC he said > that although this is a bug it's not one that can currently have > any ill effects, though I forget why (probably because this code > path is TCG only and TCG is single-threaded right now). > > exec.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/exec.c b/exec.c > index 7d60e15..0a4a0c5 100644 > --- a/exec.c > +++ b/exec.c > @@ -954,7 +954,10 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu, > iotlb |= PHYS_SECTION_ROM; > } > } else { > - iotlb = section - section->address_space->dispatch->map.sections; > + AddressSpaceDispatch *d; > + > + d = atomic_rcu_read(§ion->address_space->dispatch); > + iotlb = section - d->map.sections; > iotlb += xlat; > } > Thanks, queued for next 2.4 pull request. Paolo
diff --git a/exec.c b/exec.c index 7d60e15..0a4a0c5 100644 --- a/exec.c +++ b/exec.c @@ -954,7 +954,10 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu, iotlb |= PHYS_SECTION_ROM; } } else { - iotlb = section - section->address_space->dispatch->map.sections; + AddressSpaceDispatch *d; + + d = atomic_rcu_read(§ion->address_space->dispatch); + iotlb = section - d->map.sections; iotlb += xlat; }
When accessing the dispatch pointer in an AddressSpace within an RCU critical section we should always use atomic_rcu_read(). Fix an access within memory_region_section_get_iotlb() which was incorrectly doing a direct pointer access. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> --- I discussed this on IRC with Paolo a while back, and IIRC he said that although this is a bug it's not one that can currently have any ill effects, though I forget why (probably because this code path is TCG only and TCG is single-threaded right now). exec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)