Skip to content

Commit

Permalink
KVM: fix irqfd assign/deassign race
Browse files Browse the repository at this point in the history
I think I see the following (theoretical) race:

During irqfd assign, we drop irqfds lock before we
schedule inject work. Therefore, deassign running
on another CPU could cause shutdown and flush to run
before inject, causing user after free in inject.

A simple fix it to schedule inject under the lock.

Signed-off-by: Michael S. Tsirkin <[email protected]>
Acked-by: Gregory Haskins <[email protected]>
Signed-off-by: Marcelo Tosatti <[email protected]>
  • Loading branch information
mstsirkin authored and matosatti committed Sep 23, 2010
1 parent c79bd89 commit 6bbfb26
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion virt/kvm/eventfd.c
Original file line number Diff line number Diff line change
Expand Up @@ -218,7 +218,6 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
events = file->f_op->poll(file, &irqfd->pt);

list_add_tail(&irqfd->list, &kvm->irqfds.items);
spin_unlock_irq(&kvm->irqfds.lock);

/*
* Check if there was an event already pending on the eventfd
Expand All @@ -227,6 +226,8 @@ kvm_irqfd_assign(struct kvm *kvm, int fd, int gsi)
if (events & POLLIN)
schedule_work(&irqfd->inject);

spin_unlock_irq(&kvm->irqfds.lock);

/*
* do not drop the file until the irqfd is fully initialized, otherwise
* we might race against the POLLHUP
Expand Down

0 comments on commit 6bbfb26

Please sign in to comment.