diff options
| author | Emilio G. Cota <cota@braap.org> | 2017-10-19 16:31:54 -0400 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2017-10-24 13:53:42 -0700 |
| commit | cc689485ee3e9dca05765326ee8fd619a6ec48f0 (patch) | |
| tree | 11cdf0160feabe75a888736d1cbd4d99c7881c6e /accel | |
| parent | 1c2adb958fc07e5b3e81ed21b801c04a15f41f4f (diff) | |
| download | qemu-cc689485ee3e9dca05765326ee8fd619a6ec48f0.tar.gz | |
translate-all: exit from tb_phys_invalidate if qht_remove fails
Two or more threads might race while invalidating the same TB. We currently
do not check for this at all despite taking tb_lock, which means we would
wrongly invalidate the same TB more than once. This bug has actually been
hit by users: I recently saw a report on IRC, although I have yet to see
the corresponding test case.
Fix this by using qht_remove as the synchronization point; if it fails,
that means the TB has already been invalidated, and therefore there
is nothing left to do in tb_phys_invalidate.
Note that this solution works now that we still have tb_lock, and will
continue working once we remove tb_lock.
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-Id: <1508445114-4717-1-git-send-email-cota@braap.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'accel')
| -rw-r--r-- | accel/tcg/translate-all.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c index 5724149289..34c5e28d07 100644 --- a/accel/tcg/translate-all.c +++ b/accel/tcg/translate-all.c @@ -1079,7 +1079,9 @@ void tb_phys_invalidate(TranslationBlock *tb, tb_page_addr_t page_addr) phys_pc = tb->page_addr[0] + (tb->pc & ~TARGET_PAGE_MASK); h = tb_hash_func(phys_pc, tb->pc, tb->flags, tb->cflags & CF_HASH_MASK, tb->trace_vcpu_dstate); - qht_remove(&tb_ctx.htable, tb, h); + if (!qht_remove(&tb_ctx.htable, tb, h)) { + return; + } /* remove the TB from the page list */ if (tb->page_addr[0] != page_addr) { |