From patchwork Mon Mar 2 10:08:53 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Bonzini X-Patchwork-Id: 445015 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 76CF8140172 for ; Mon, 2 Mar 2015 21:12:10 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="verification failed; unprotected key" header.d=gmail.com header.i=@gmail.com header.b=leXTx5Xl; dkim-adsp=none (unprotected policy); dkim-atps=neutral Received: from localhost ([::1]:55953 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSNKa-0005l4-EG for incoming@patchwork.ozlabs.org; Mon, 02 Mar 2015 05:12:08 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33369) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSNHy-00021y-7v for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YSNHx-0007rc-5m for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:26 -0500 Received: from mail-wg0-x22c.google.com ([2a00:1450:400c:c00::22c]:44843) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSNHw-0007rY-Vi for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:25 -0500 Received: by wggx12 with SMTP id x12so32303831wgg.11 for ; Mon, 02 Mar 2015 02:09:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:subject:date:message-id:in-reply-to:references; bh=qq7n8f9xYb0iLOpwOew9gl5kaXQQZh0xrQpb3snuY34=; b=leXTx5XlTaDQf1+wAq068jbdoO6TTt2uCYZD+QwCgw1Zbty27M17B7Le0atXT1iEYu NDB61V5mdBZGrZKrpjSFMkJzr+223MKqaNVY0pDWs/D6hDbaa1zDwr5B83r942c7LP8V 05XzJwpqOJ2faDB+mqaVkwT7S/RuM0Mmi9ST5j98YIrP6H2+XBNyQHcPJ2hgsX8u9vz3 2HAKZ2XVO3yyB1Eiq1zQWUVovaRjENmamf5jU+M5wjT2QvAEfTjpFWLluzck3iPFNJkJ rdHGKGjyknhkykWbDfIwpbml7DDcf/rGO4/liOoORRYhk9qSnQYksdF8C6h7L45qIYko S4yA== X-Received: by 10.180.75.108 with SMTP id b12mr33729592wiw.44.1425290964569; Mon, 02 Mar 2015 02:09:24 -0800 (PST) Received: from localhost.localdomain (net-37-116-207-136.cust.vodafonedsl.it. [37.116.207.136]) by mx.google.com with ESMTPSA id g10sm15364685wic.7.2015.03.02.02.09.22 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Mar 2015 02:09:23 -0800 (PST) From: Paolo Bonzini To: qemu-devel@nongnu.org Date: Mon, 2 Mar 2015 11:08:53 +0100 Message-Id: <1425290934-60872-15-git-send-email-pbonzini@redhat.com> X-Mailer: git-send-email 2.3.0 In-Reply-To: <1425290934-60872-1-git-send-email-pbonzini@redhat.com> References: <1425290934-60872-1-git-send-email-pbonzini@redhat.com> X-detected-operating-system: by eggs.gnu.org: Error: Malformed IPv6 address (bad octet value). X-Received-From: 2a00:1450:400c:c00::22c Subject: [Qemu-devel] [PULL 14/15] cpus: fix deadlock and segfault in qemu_mutex_lock_iothread X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org When two threads (other than the low-priority TCG VCPU thread) are competing for the iothread lock, a deadlock can happen. This is because iothread_requesting_mutex is set to false by the first thread that gets the mutex, and then the VCPU thread might never yield from the execution loop. If iothread_requesting_mutex is changed from a bool to a counter, the deadlock is fixed. However, there is another bug in qemu_mutex_lock_iothread that can be triggered by the new call_rcu thread. The bug happens if qemu_mutex_lock_iothread is called before the CPUs are created. In that case, first_cpu is NULL and the caller segfaults in qemu_mutex_lock_iothread. To fix this, just do not do the kick if first_cpu is NULL. Reported-by: Leon Alrae Reported-by: Andreas Gustafsson Tested-by: Leon Alrae Signed-off-by: Paolo Bonzini --- cpus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cpus.c b/cpus.c index 1cd9867..83c078e 100644 --- a/cpus.c +++ b/cpus.c @@ -778,7 +778,7 @@ static void qemu_tcg_init_cpu_signals(void) static QemuMutex qemu_global_mutex; static QemuCond qemu_io_proceeded_cond; -static bool iothread_requesting_mutex; +static unsigned iothread_requesting_mutex; static QemuThread io_thread; @@ -1115,15 +1115,15 @@ bool qemu_in_vcpu_thread(void) void qemu_mutex_lock_iothread(void) { - if (!tcg_enabled()) { + if (!tcg_enabled() || !first_cpu) { qemu_mutex_lock(&qemu_global_mutex); } else { - iothread_requesting_mutex = true; + atomic_inc(&iothread_requesting_mutex); if (qemu_mutex_trylock(&qemu_global_mutex)) { qemu_cpu_kick_thread(first_cpu); qemu_mutex_lock(&qemu_global_mutex); } - iothread_requesting_mutex = false; + atomic_dec(&iothread_requesting_mutex); qemu_cond_broadcast(&qemu_io_proceeded_cond); } }