From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:33369) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSNHy-00021y-7v for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:27 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1YSNHx-0007rc-5m for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:26 -0500 Received: from mail-wg0-x22c.google.com ([2a00:1450:400c:c00::22c]:44843) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1YSNHw-0007rY-Vi for qemu-devel@nongnu.org; Mon, 02 Mar 2015 05:09:25 -0500 Received: by wggx12 with SMTP id x12so32303831wgg.11 for ; Mon, 02 Mar 2015 02:09:24 -0800 (PST) Received: from localhost.localdomain (net-37-116-207-136.cust.vodafonedsl.it. [37.116.207.136]) by mx.google.com with ESMTPSA id g10sm15364685wic.7.2015.03.02.02.09.22 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 02 Mar 2015 02:09:23 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Mon, 2 Mar 2015 11:08:53 +0100 Message-Id: <1425290934-60872-15-git-send-email-pbonzini@redhat.com> In-Reply-To: <1425290934-60872-1-git-send-email-pbonzini@redhat.com> References: <1425290934-60872-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PULL 14/15] cpus: fix deadlock and segfault in qemu_mutex_lock_iothread List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org When two threads (other than the low-priority TCG VCPU thread) are competing for the iothread lock, a deadlock can happen. This is because iothread_requesting_mutex is set to false by the first thread that gets the mutex, and then the VCPU thread might never yield from the execution loop. If iothread_requesting_mutex is changed from a bool to a counter, the deadlock is fixed. However, there is another bug in qemu_mutex_lock_iothread that can be triggered by the new call_rcu thread. The bug happens if qemu_mutex_lock_iothread is called before the CPUs are created. In that case, first_cpu is NULL and the caller segfaults in qemu_mutex_lock_iothread. To fix this, just do not do the kick if first_cpu is NULL. Reported-by: Leon Alrae Reported-by: Andreas Gustafsson Tested-by: Leon Alrae Signed-off-by: Paolo Bonzini --- cpus.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/cpus.c b/cpus.c index 1cd9867..83c078e 100644 --- a/cpus.c +++ b/cpus.c @@ -778,7 +778,7 @@ static void qemu_tcg_init_cpu_signals(void) static QemuMutex qemu_global_mutex; static QemuCond qemu_io_proceeded_cond; -static bool iothread_requesting_mutex; +static unsigned iothread_requesting_mutex; static QemuThread io_thread; @@ -1115,15 +1115,15 @@ bool qemu_in_vcpu_thread(void) void qemu_mutex_lock_iothread(void) { - if (!tcg_enabled()) { + if (!tcg_enabled() || !first_cpu) { qemu_mutex_lock(&qemu_global_mutex); } else { - iothread_requesting_mutex = true; + atomic_inc(&iothread_requesting_mutex); if (qemu_mutex_trylock(&qemu_global_mutex)) { qemu_cpu_kick_thread(first_cpu); qemu_mutex_lock(&qemu_global_mutex); } - iothread_requesting_mutex = false; + atomic_dec(&iothread_requesting_mutex); qemu_cond_broadcast(&qemu_io_proceeded_cond); } } -- 2.3.0