summaryrefslogtreecommitdiff
path: root/sys/dev
diff options
context:
space:
mode:
authoryamaguchi <yamaguchi@NetBSD.org>2023-04-21 02:17:32 +0000
committeryamaguchi <yamaguchi@NetBSD.org>2023-04-21 02:17:32 +0000
commit48bba19337bd992c2d451f9fecf262f5882d3a46 (patch)
treefd2a7b7be37438853e93615ec425c8842d943ddd /sys/dev
parentdf34ba18be1a0eec3addf41c1e8c54d62c76e2f8 (diff)
virtio(4): change members of struct vring_desc_extra before free a slot
This prevents the following race condition. 1. Thread-A: calls virtio_dequeue_commit() and puts a slot into free descriptor chain in vq_free_slot() 2. Thread-B: calls virtio_enqueue_prep() and get the slot stored by Thread-A 3. Thread-B: calls virtio_enqueue_reserve() and changes desc_base and desc_free_idx for the slot 4. Thread-A: changes the same members updated by Thread-B reported by hannken, thanks.
Diffstat (limited to 'sys/dev')
-rw-r--r--sys/dev/pci/virtio.c12
1 files changed, 6 insertions, 6 deletions
diff --git a/sys/dev/pci/virtio.c b/sys/dev/pci/virtio.c
index d68301ffb95..7366be5355e 100644
--- a/sys/dev/pci/virtio.c
+++ b/sys/dev/pci/virtio.c
@@ -1,4 +1,4 @@
-/* $NetBSD: virtio.c,v 1.77 2023/04/19 00:40:30 yamaguchi Exp $ */
+/* $NetBSD: virtio.c,v 1.78 2023/04/21 02:17:32 yamaguchi Exp $ */
/*
* Copyright (c) 2020 The NetBSD Foundation, Inc.
@@ -28,7 +28,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.77 2023/04/19 00:40:30 yamaguchi Exp $");
+__KERNEL_RCSID(0, "$NetBSD: virtio.c,v 1.78 2023/04/21 02:17:32 yamaguchi Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -1258,12 +1258,12 @@ virtio_enqueue_abort(struct virtio_softc *sc, struct virtqueue *vq, int slot)
{
struct vring_desc_extra *vdx;
- vq_free_slot(sc, vq, slot);
-
vdx = &vq->vq_descx[slot];
vdx->desc_free_idx = VRING_DESC_CHAIN_END;
vdx->desc_base = NULL;
+ vq_free_slot(sc, vq, slot);
+
return 0;
}
@@ -1308,12 +1308,12 @@ virtio_dequeue_commit(struct virtio_softc *sc, struct virtqueue *vq, int slot)
{
struct vring_desc_extra *vdx;
- vq_free_slot(sc, vq, slot);
-
vdx = &vq->vq_descx[slot];
vdx->desc_base = NULL;
vdx->desc_free_idx = VRING_DESC_CHAIN_END;
+ vq_free_slot(sc, vq, slot);
+
return 0;
}