From e3375c7ffb90a8f72c219109840b8b6e51a10a12 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Wed, 5 Sep 2012 15:09:48 +0200 Subject: [PATCH] x86: fix RCU locking in PHYSDEVOP_get_free_pirq Apart from properly pairing locks with unlocks, also reduce the lock scope - no need to do the copy_{from,to}_guest()-s inside the protected region. I actually wonder whether the RCU locks are needed here at all. Reported-by: Tim Deegan Signed-off-by: Jan Beulich Acked-by: Keir Fraser --- xen/arch/x86/physdev.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/xen/arch/x86/physdev.c b/xen/arch/x86/physdev.c index a39d6ac6b4..8e7bc24b62 100644 --- a/xen/arch/x86/physdev.c +++ b/xen/arch/x86/physdev.c @@ -698,13 +698,13 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg) struct physdev_get_free_pirq out; struct domain *d; - d = rcu_lock_current_domain(); - ret = -EFAULT; if ( copy_from_guest(&out, arg, 1) != 0 ) break; + d = rcu_lock_current_domain(); spin_lock(&d->event_lock); + ret = get_free_pirq(d, out.type); if ( ret >= 0 ) { @@ -715,7 +715,9 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg) else ret = -ENOMEM; } + spin_unlock(&d->event_lock); + rcu_unlock_domain(d); if ( ret >= 0 ) { @@ -723,7 +725,6 @@ ret_t do_physdev_op(int cmd, XEN_GUEST_HANDLE(void) arg) ret = copy_to_guest(arg, &out, 1) ? -EFAULT : 0; } - rcu_unlock_domain(d); break; } default: -- 2.30.2