From patchwork Thu May 20 16:58:06 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Stevens X-Patchwork-Id: 101215 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by demeter.kernel.org (8.14.3/8.14.3) with ESMTP id o4KGwLpb002000 for ; Thu, 20 May 2010 16:58:21 GMT Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753510Ab0ETQ6S (ORCPT ); Thu, 20 May 2010 12:58:18 -0400 Received: from e3.ny.us.ibm.com ([32.97.182.143]:34578 "EHLO e3.ny.us.ibm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751835Ab0ETQ6Q (ORCPT ); Thu, 20 May 2010 12:58:16 -0400 Received: from d01relay06.pok.ibm.com (d01relay06.pok.ibm.com [9.56.227.116]) by e3.ny.us.ibm.com (8.14.3/8.13.1) with ESMTP id o4KGjJFm001870; Thu, 20 May 2010 12:45:19 -0400 Received: from d01av04.pok.ibm.com (d01av04.pok.ibm.com [9.56.224.64]) by d01relay06.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id o4KGw9Kp2039908; Thu, 20 May 2010 12:58:09 -0400 Received: from d01av04.pok.ibm.com (loopback [127.0.0.1]) by d01av04.pok.ibm.com (8.14.3/8.13.1/NCO v10.0 AVout) with ESMTP id o4KGw8RL016587; Thu, 20 May 2010 12:58:09 -0400 Received: from [9.47.18.17] (w-dls.beaverton.ibm.com [9.47.18.17]) by d01av04.pok.ibm.com (8.14.3/8.13.1/NCO v10.0 AVin) with ESMTP id o4KGw7U9016455; Thu, 20 May 2010 12:58:07 -0400 Subject: [PATCH][VHOST] fix race with guest on multi-buffer used buffer updates From: David L Stevens Reply-To: dlstevens@us.ibm.com To: mst@redhat.com Cc: netdev@vger.kernel.org, kvm@vger.kernel.org Organization: IBM Date: Thu, 20 May 2010 09:58:06 -0700 Message-ID: <1274374686.8492.12.camel@w-dls.beaverton.ibm.com> Mime-Version: 1.0 X-Mailer: Evolution 2.28.3 (2.28.3-1.fc12) Sender: kvm-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: kvm@vger.kernel.org X-Greylist: IP, sender and recipient auto-whitelisted, not delayed by milter-greylist-4.2.3 (demeter.kernel.org [140.211.167.41]); Thu, 20 May 2010 16:58:21 +0000 (UTC) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 7f2568d..74790ab 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1065,14 +1065,6 @@ static int __vhost_add_used_n(struct vhost_virtqueue *vq, vq_err(vq, "Failed to write used"); return -EFAULT; } - /* Make sure buffer is written before we update index. */ - smp_wmb(); - if (put_user(vq->last_used_idx + count, &vq->used->idx)) { - vq_err(vq, "Failed to increment used idx"); - return -EFAULT; - } - if (unlikely(vq->log_used)) - vhost_log_used(vq, used); vq->last_used_idx += count; return 0; } @@ -1093,7 +1085,17 @@ int vhost_add_used_n(struct vhost_virtqueue *vq, struct vring_used_elem *heads, heads += n; count -= n; } - return __vhost_add_used_n(vq, heads, count); + r = __vhost_add_used_n(vq, heads, count); + + /* Make sure buffer is written before we update index. */ + smp_wmb(); + if (put_user(vq->last_used_idx, &vq->used->idx)) { + vq_err(vq, "Failed to increment used idx"); + return -EFAULT; + } + if (unlikely(vq->log_used)) + vhost_log_used(vq, vq->used->ring + start); + return r; } /* This actually signals the guest, using eventfd. */