KVM: x86: disallow multiple KVM_CREATE_IRQCHIP

Otherwise kvm will leak memory on multiple KVM_CREATE_IRQCHIP.
Also serialize multiple accesses with kvm->lock.

Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Signed-off-by: Avi Kivity <avi@redhat.com>
This commit is contained in:
Marcelo Tosatti 2009-10-29 13:44:15 -02:00 committed by Avi Kivity
parent 92c0d90015
commit 3ddea128ad
2 changed files with 27 additions and 9 deletions

View File

@ -86,7 +86,11 @@ static inline struct kvm_pic *pic_irqchip(struct kvm *kvm)
static inline int irqchip_in_kernel(struct kvm *kvm) static inline int irqchip_in_kernel(struct kvm *kvm)
{ {
return pic_irqchip(kvm) != NULL; int ret;
ret = (pic_irqchip(kvm) != NULL);
smp_rmb();
return ret;
} }
void kvm_pic_reset(struct kvm_kpic_state *s); void kvm_pic_reset(struct kvm_kpic_state *s);

View File

@ -2362,25 +2362,39 @@ long kvm_arch_vm_ioctl(struct file *filp,
if (r) if (r)
goto out; goto out;
break; break;
case KVM_CREATE_IRQCHIP: case KVM_CREATE_IRQCHIP: {
struct kvm_pic *vpic;
mutex_lock(&kvm->lock);
r = -EEXIST;
if (kvm->arch.vpic)
goto create_irqchip_unlock;
r = -ENOMEM; r = -ENOMEM;
kvm->arch.vpic = kvm_create_pic(kvm); vpic = kvm_create_pic(kvm);
if (kvm->arch.vpic) { if (vpic) {
r = kvm_ioapic_init(kvm); r = kvm_ioapic_init(kvm);
if (r) { if (r) {
kfree(kvm->arch.vpic); kfree(vpic);
kvm->arch.vpic = NULL; goto create_irqchip_unlock;
goto out;
} }
} else } else
goto out; goto create_irqchip_unlock;
smp_wmb();
kvm->arch.vpic = vpic;
smp_wmb();
r = kvm_setup_default_irq_routing(kvm); r = kvm_setup_default_irq_routing(kvm);
if (r) { if (r) {
mutex_lock(&kvm->irq_lock);
kfree(kvm->arch.vpic); kfree(kvm->arch.vpic);
kfree(kvm->arch.vioapic); kfree(kvm->arch.vioapic);
goto out; kvm->arch.vpic = NULL;
kvm->arch.vioapic = NULL;
mutex_unlock(&kvm->irq_lock);
} }
create_irqchip_unlock:
mutex_unlock(&kvm->lock);
break; break;
}
case KVM_CREATE_PIT: case KVM_CREATE_PIT:
u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY; u.pit_config.flags = KVM_PIT_SPEAKER_DUMMY;
goto create_pit; goto create_pit;