Re: [RFC -v5 PATCH 1/4] kvm: keep track of which task is running a KVM vcpu

Avi Kivity
2011-01-16T15:18:12Z

On 01/14/2011 10:03 AM, Rik van Riel wrote:
> Keep track of which task is running a KVM vcpu. This helps us
> figure out later what task to wake up if we want to boost a
> vcpu that got preempted.
>
> Unfortunately there are no guarantees that the same task
> always keeps the same vcpu, so we can only track the task
> across a single "run" of the vcpu.
>
>
> diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
> index 5225052..65e997a 100644
> --- a/virt/kvm/kvm_main.c
> +++ b/virt/kvm/kvm_main.c
> @@ -185,6 +185,7 @@ int kvm_vcpu_init(struct kvm_vcpu *vcpu, struct kvm *kvm, unsigned id)
> vcpu->cpu = -1;
> vcpu->kvm = kvm;
> vcpu->vcpu_id = id;
> + vcpu->pid = 0;

NULL

> @@ -1456,6 +1459,12 @@ static long kvm_vcpu_ioctl(struct file *filp,
> r = -EINVAL;
> if (arg)
> goto out;
> + if (unlikely(vcpu->pid != current->pids[PIDTYPE_PID].pid)) {
> + /* The thread running this VCPU changed. */
> + struct pid *oldpid = vcpu->pid;
> + vcpu->pid = get_task_pid(current, PIDTYPE_PID);
> + put_pid(oldpid);
> + }

This is subject to the same race as before. If another vcpu picks up
vcpu->pid before the assignment (that is, oldpid), but dereferences it
after put_pid(), it hits freed memory.

You want something like

struct pid *oldpid = vcpu->pid;
rcu_assign_pointer(vcpu->pid, get_task_pid());
synchronize_rcu();
put_pid(oldpid);

with rcu_read_lock() / rcu_dereference() protection on the reader side.

--
error compiling committee.c: too many arguments to function