Re: [Qemu-devel] [PATCH] queue: fix QSLIST_INSERT_HEAD_ATOMIC race

[Christian Borntraeger <borntraeger@de.ibm.com>]

Am 10.03.2015 um 16:45 schrieb Paolo Bonzini:
[...]
> 
> Moral of the story: I should refrain from writing more clever stuff.
> At least it looks like it is not too clever to be undebuggable.
> 
> Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
> Fixes: c740ad92d0d958fa785e5d7aa1b67ecaf30a6a54
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Tested-by: Christian Borntraeger <borntraeger@de.ibm.com>

> ---
>  include/qemu/queue.h | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 
> diff --git a/include/qemu/queue.h b/include/qemu/queue.h
> index 8094150..f781aa2 100644
> --- a/include/qemu/queue.h
> +++ b/include/qemu/queue.h
> @@ -197,11 +197,12 @@ struct {                                                                \
>          (head)->slh_first = (elm);                                       \
>  } while (/*CONSTCOND*/0)
> 
> -#define QSLIST_INSERT_HEAD_ATOMIC(head, elm, field) do {                   \
> -        do {                                                               \
> -            (elm)->field.sle_next = (head)->slh_first;                     \
> -        } while (atomic_cmpxchg(&(head)->slh_first, (elm)->field.sle_next, \
> -                               (elm)) != (elm)->field.sle_next);           \
> +#define QSLIST_INSERT_HEAD_ATOMIC(head, elm, field) do {                     \
> +        typeof(elm) save_sle_next;                                           \
> +        do {                                                                 \
> +            save_sle_next = (elm)->field.sle_next = (head)->slh_first;       \
> +        } while (atomic_cmpxchg(&(head)->slh_first, save_sle_next, (elm)) != \
> +                 save_sle_next);                                             \
>  } while (/*CONSTCOND*/0)
> 
>  #define QSLIST_MOVE_ATOMIC(dest, src) do {                               \
>