diff mbox

exec.c: Use atomic_rcu_read() to access dispatch in memory_region_section_get_iotlb()

Message ID 1437391637-31576-1-git-send-email-peter.maydell@linaro.org
State New
Headers show

Commit Message

Peter Maydell July 20, 2015, 11:27 a.m. UTC 
When accessing the dispatch pointer in an AddressSpace within an RCU
critical section we should always use atomic_rcu_read(). Fix an
access within memory_region_section_get_iotlb() which was incorrectly
doing a direct pointer access.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
I discussed this on IRC with Paolo a while back, and IIRC he said
that although this is a bug it's not one that can currently have
any ill effects, though I forget why (probably because this code
path is TCG only and TCG is single-threaded right now).

 exec.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

Comments

Paolo Bonzini July 21, 2015, 8:50 a.m. UTC | #1 
On 20/07/2015 13:27, Peter Maydell wrote:
> When accessing the dispatch pointer in an AddressSpace within an RCU
> critical section we should always use atomic_rcu_read(). Fix an
> access within memory_region_section_get_iotlb() which was incorrectly
> doing a direct pointer access.
> 
> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
> ---
> I discussed this on IRC with Paolo a while back, and IIRC he said
> that although this is a bug it's not one that can currently have
> any ill effects, though I forget why (probably because this code
> path is TCG only and TCG is single-threaded right now).
> 
>  exec.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/exec.c b/exec.c
> index 7d60e15..0a4a0c5 100644
> --- a/exec.c
> +++ b/exec.c
> @@ -954,7 +954,10 @@ hwaddr memory_region_section_get_iotlb(CPUState *cpu,
>              iotlb |= PHYS_SECTION_ROM;
>          }
>      } else {
> -        iotlb = section - section->address_space->dispatch->map.sections;
> +        AddressSpaceDispatch *d;
> +
> +        d = atomic_rcu_read(&section->address_space->dispatch);
> +        iotlb = section - d->map.sections;
>          iotlb += xlat;
>      }
>  

Thanks, queued for next 2.4 pull request.

Paolo
diff mbox

Patch

diff --git a/exec.c b/exec.c
index 7d60e15..0a4a0c5 100644
--- a/exec.c
+++ b/exec.c
@@ -954,7 +954,10 @@  hwaddr memory_region_section_get_iotlb(CPUState *cpu,
             iotlb |= PHYS_SECTION_ROM;
         }
     } else {
-        iotlb = section - section->address_space->dispatch->map.sections;
+        AddressSpaceDispatch *d;
+
+        d = atomic_rcu_read(&section->address_space->dispatch);
+        iotlb = section - d->map.sections;
         iotlb += xlat;
     }