From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jan Kiszka Subject: [PATCH] kvm: x86: Fix racy event propagation in kmv timer Date: Tue, 09 Jun 2009 11:28:27 +0200 Message-ID: <4A2E2B3B.5020408@siemens.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-15 Content-Transfer-Encoding: 7bit Cc: Marcelo Tosatti To: Avi Kivity , kvm-devel Return-path: Received: from gecko.sbs.de ([194.138.37.40]:16244 "EHLO gecko.sbs.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757145AbZFIJ2n (ORCPT ); Tue, 9 Jun 2009 05:28:43 -0400 Sender: kvm-owner@vger.kernel.org List-ID: Minor issues that likely had no practical relevance: The kvm timer function so far incremented the pending counter and then may reset it again to 1 in case reinjection was disabled. This opened a small racy window with the corresponding VCPU loop that may have happened to run on another (real) CPU and already consumed the value. Moveover, the previous code tried to optimize the setting of KVM_REQ_PENDING_TIMER, but used atomic_inc_and_test - which always returns true unless pending had the invalid value of -1 on entry. Signed-off-by: Jan Kiszka --- arch/x86/kvm/timer.c | 11 +++++------ 1 files changed, 5 insertions(+), 6 deletions(-) diff --git a/arch/x86/kvm/timer.c b/arch/x86/kvm/timer.c index 86dbac0..18fd17c 100644 --- a/arch/x86/kvm/timer.c +++ b/arch/x86/kvm/timer.c @@ -9,12 +9,11 @@ static int __kvm_timer_fn(struct kvm_vcpu *vcpu, struct kvm_timer *ktimer) int restart_timer = 0; wait_queue_head_t *q = &vcpu->wq; - /* FIXME: this code should not know anything about vcpus */ - if (!atomic_inc_and_test(&ktimer->pending)) - set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests); - - if (!ktimer->reinject) - atomic_set(&ktimer->pending, 1); + if (ktimer->reinject || !atomic_read(&ktimer->pending)) { + /* FIXME: this code should not know anything about vcpus */ + if (atomic_inc_return(&ktimer->pending) == 1) + set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests); + } if (waitqueue_active(q)) wake_up_interruptible(q);