[Xen-devel] [PATCH] mce: Fix race condition in mctelem_xchg_head

[Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>]

The function that exchange the head is racy.
The cmpxchg and the compare are not atomic.
Assume two thread one (T1) inserting on committed list and another
trying to comsume it (T2).
T1 start inserting the element (A), set prev pointer (commit list use
mcte_prev) then is stop after the cmpxchg succeeded.
T2 get the list and change elements (A) and update the commit list
head.
T1 resume, read pointer to prev again and compare with result from
cmpxchg which succeeded but in the meantime prev changed in memory.
Not T1 assume the element was not inserted on the list and try to
insert again. Now A however is in another state and should not be
modified by T1.
To solve the race use temporary variable for prev pointer.
Note that compiler should not optimize the memory fetch as cmpxhg
do a full barrier.

Signed-off-by: Frediano Ziglio <frediano.ziglio@xxxxxxxxxx>
---
 xen/arch/x86/cpu/mcheck/mctelem.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/xen/arch/x86/cpu/mcheck/mctelem.c 
b/xen/arch/x86/cpu/mcheck/mctelem.c
index 37d830f..5821278 100644
--- a/xen/arch/x86/cpu/mcheck/mctelem.c
+++ b/xen/arch/x86/cpu/mcheck/mctelem.c
@@ -127,13 +127,15 @@ static DEFINE_PER_CPU(struct mc_telem_cpu_ctl, mctctl);
 static DEFINE_SPINLOCK(processing_lock);
 
 static void mctelem_xchg_head(struct mctelem_ent **headp,
-                               struct mctelem_ent **old,
+                               struct mctelem_ent **oldp,
                                struct mctelem_ent *new)
 {
+       struct mctelem_ent *old;
+
        for (;;) {
-               *old = *headp;
+               *oldp = old = *headp;
                wmb();
-               if (cmpxchgptr(headp, *old, new) == *old)
+               if (cmpxchgptr(headp, old, new) == old)
                        break;
        }
 }
-- 
1.7.10.4



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel