From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57380) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YRQEg-0007BT-0S for qemu-devel@nongnu.org; Fri, 27 Feb 2015 14:06:06 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YRQEb-0005PX-4A for qemu-devel@nongnu.org; Fri, 27 Feb 2015 14:06:05 -0500 Received: from mail-we0-x22b.google.com ([2a00:1450:400c:c03::22b]:38373) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YRQEa-0005PD-Tq for qemu-devel@nongnu.org; Fri, 27 Feb 2015 14:06:01 -0500 Received: by wesw55 with SMTP id w55so22169011wes.5 for ; Fri, 27 Feb 2015 11:06:00 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 27 Feb 2015 20:05:50 +0100 Message-Id: <1425063951-16967-2-git-send-email-pbonzini@redhat.com> In-Reply-To: <1425063951-16967-1-git-send-email-pbonzini@redhat.com> References: <1425063951-16967-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 1/2] cpus: fix deadlock and segfault in qemu_mutex_lock_iothread List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: leon.alrae@imgtec.com, gson@gson.org When two threads (other than the low-priority TCG VCPU thread) are competing for the iothread lock, a deadlock can happen. This is because iothread_requesting_mutex is set to false by the first thread that gets the mutex, and then the VCPU thread might never yield from the execution loop. If iothread_requesting_mutex is changed from a bool to a counter, the deadlock is fixed. However, there is another bug in qemu_mutex_lock_iothread that can be triggered by the new call_rcu thread. The bug happens if qemu_mutex_lock_iothread is called before the CPUs are created. In that case, first_cpu is NULL and the caller segfaults in qemu_mutex_lock_iothread. To fix this, just do not do the kick if first_cpu is NULL. Reported-by: Leon Alrae Reported-by: Andreas Gustafsson Signed-off-by: Paolo Bonzini --- cpus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cpus.c b/cpus.c index 1cd9867..83c078e 100644 --- a/cpus.c +++ b/cpus.c @@ -778,7 +778,7 @@ static void qemu_tcg_init_cpu_signals(void) static QemuMutex qemu_global_mutex; static QemuCond qemu_io_proceeded_cond; -static bool iothread_requesting_mutex; +static unsigned iothread_requesting_mutex; static QemuThread io_thread; @@ -1115,15 +1115,15 @@ bool qemu_in_vcpu_thread(void) void qemu_mutex_lock_iothread(void) { - if (!tcg_enabled()) { + if (!tcg_enabled() || !first_cpu) { qemu_mutex_lock(&qemu_global_mutex); } else { - iothread_requesting_mutex = true; + atomic_inc(&iothread_requesting_mutex); if (qemu_mutex_trylock(&qemu_global_mutex)) { qemu_cpu_kick_thread(first_cpu); qemu_mutex_lock(&qemu_global_mutex); } - iothread_requesting_mutex = false; + atomic_dec(&iothread_requesting_mutex); qemu_cond_broadcast(&qemu_io_proceeded_cond); } } -- 2.3.0