diff mbox

kvm: x86: Fix racy event propagation in kmv timer

Message ID 4A2E2B3B.5020408@siemens.com (mailing list archive)
State New, archived
Headers show

Commit Message

Jan Kiszka June 9, 2009, 9:28 a.m. UTC
Minor issues that likely had no practical relevance: The kvm timer
function so far incremented the pending counter and then may reset it
again to 1 in case reinjection was disabled. This opened a small racy
window with the corresponding VCPU loop that may have happened to run on
another (real) CPU and already consumed the value.

Moveover, the previous code tried to optimize the setting of
KVM_REQ_PENDING_TIMER, but used atomic_inc_and_test - which always
returns true unless pending had the invalid value of -1 on entry.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>

 arch/x86/kvm/timer.c |   11 +++++------
 1 files changed, 5 insertions(+), 6 deletions(-)

To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox


diff --git a/arch/x86/kvm/timer.c b/arch/x86/kvm/timer.c
index 86dbac0..18fd17c 100644
--- a/arch/x86/kvm/timer.c
+++ b/arch/x86/kvm/timer.c
@@ -9,12 +9,11 @@  static int __kvm_timer_fn(struct kvm_vcpu *vcpu, struct kvm_timer *ktimer)
 	int restart_timer = 0;
 	wait_queue_head_t *q = &vcpu->wq;
-	/* FIXME: this code should not know anything about vcpus */
-	if (!atomic_inc_and_test(&ktimer->pending))
-		set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);
-	if (!ktimer->reinject)
-		atomic_set(&ktimer->pending, 1);
+	if (ktimer->reinject || !atomic_read(&ktimer->pending)) {
+		/* FIXME: this code should not know anything about vcpus */
+		if (atomic_inc_return(&ktimer->pending) == 1)
+			set_bit(KVM_REQ_PENDING_TIMER, &vcpu->requests);
+	}
 	if (waitqueue_active(q))