• Pekka Paalanen's avatar
    x86 mmiotrace: fix race with release_kmmio_fault_page() · 340430c5
    Pekka Paalanen authored
    There was a theoretical possibility to a race between arming a page in
    post_kmmio_handler() and disarming the page in
    release_kmmio_fault_page():
    
    cpu0                             cpu1
    ------------------------------------------------------------------
    mmiotrace shutdown
    enter release_kmmio_fault_page
                                     fault on the page
                                     disarm the page
    disarm the page
                                     handle the MMIO access
                                     re-arm the page
    put the page on release list
    remove_kmmio_fault_pages()
                                     fault on the page
                                     page not known to mmiotrace
                                     fall back to do_page_fault()
                                     *KABOOM*
    
    (This scenario also shows the double disarm case which is allowed.)
    
    Fixed by acquiring kmmio_lock in post_kmmio_handler() and checking
    if the page is being released from mmiotrace.
    Signed-off-by: default avatarPekka Paalanen <pq@iki.fi>
    Cc: Stuart Bennett <stuart@freedesktop.org>
    Cc: Steven Rostedt <rostedt@goodmis.org>
    Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
    340430c5
kmmio.c 14.7 KB