Commit 3898da94 authored by Paolo Bonzini's avatar Paolo Bonzini Committed by Radim Krčmář
Browse files

KVM: avoid using rcu_dereference_protected 



During teardown, accesses to memslots and buses are using
rcu_dereference_protected with an always-true condition because
these accesses are done outside the usual mutexes.  This
is because the last reference is gone and there cannot be any
concurrent modifications, but rcu_dereference_protected is
ugly and unobvious.

Instead, check the refcount in kvm_get_bus and __kvm_memslots.

Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
Signed-off-by: default avatarRadim Krčmář <rkrcmar@redhat.com>
parent ebd28fcb

include/linux/kvm_host.h

+4 −2
Original line number Diff line number Diff line
@@ -477,7 +477,8 @@ struct kvm { 
static inline struct kvm_io_bus *kvm_get_bus(struct kvm *kvm, enum kvm_bus idx)

{

	return srcu_dereference_check(kvm->buses[idx], &kvm->srcu,

				      lockdep_is_held(&kvm->slots_lock));

				      lockdep_is_held(&kvm->slots_lock) ||

				      !refcount_read(&kvm->users_count));

}



static inline struct kvm_vcpu *kvm_get_vcpu(struct kvm *kvm, int i)
@@ -570,7 +571,8 @@ void kvm_put_kvm(struct kvm *kvm); 
static inline struct kvm_memslots *__kvm_memslots(struct kvm *kvm, int as_id)

{

	return srcu_dereference_check(kvm->memslots[as_id], &kvm->srcu,

			lockdep_is_held(&kvm->slots_lock));

			lockdep_is_held(&kvm->slots_lock) ||

			!refcount_read(&kvm->users_count));

}



static inline struct kvm_memslots *kvm_memslots(struct kvm *kvm)

virt/kvm/kvm_main.c

+4 −7
Original line number Diff line number Diff line
@@ -717,10 +717,9 @@ out_err_no_srcu: 
	hardware_disable_all();

out_err_no_disable:

	for (i = 0; i < KVM_NR_BUSES; i++)

		kfree(rcu_access_pointer(kvm->buses[i]));

		kfree(kvm_get_bus(kvm, i));

	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)

		kvm_free_memslots(kvm,

			rcu_dereference_protected(kvm->memslots[i], 1));

		kvm_free_memslots(kvm, __kvm_memslots(kvm, i));

	kvm_arch_free_vm(kvm);

	mmdrop(current->mm);

	return ERR_PTR(r);
@@ -754,9 +753,8 @@ static void kvm_destroy_vm(struct kvm *kvm) 
	spin_unlock(&kvm_lock);

	kvm_free_irq_routing(kvm);

	for (i = 0; i < KVM_NR_BUSES; i++) {

		struct kvm_io_bus *bus;

		struct kvm_io_bus *bus = kvm_get_bus(kvm, i);



		bus = rcu_dereference_protected(kvm->buses[i], 1);

		if (bus)

			kvm_io_bus_destroy(bus);

		kvm->buses[i] = NULL;
@@ -770,8 +768,7 @@ static void kvm_destroy_vm(struct kvm *kvm) 
	kvm_arch_destroy_vm(kvm);

	kvm_destroy_devices(kvm);

	for (i = 0; i < KVM_ADDRESS_SPACE_NUM; i++)

		kvm_free_memslots(kvm,

			rcu_dereference_protected(kvm->memslots[i], 1));

		kvm_free_memslots(kvm, __kvm_memslots(kvm, i));

	cleanup_srcu_struct(&kvm->irq_srcu);

	cleanup_srcu_struct(&kvm->srcu);

	kvm_arch_free_vm(kvm);

CRA Git | Maintained and supported by SUSTech CRA and CCSE