KVM: fix the race while wakeup all pv guest

In kvm_async_pf_wakeup_all(), we add a dummy apf to vcpu->async_pf.done
without holding vcpu->async_pf.lock, it will break if we are handling apfs
at this time.

Also use 'list_empty_careful()' instead of 'list_empty()'

Signed-off-by: Xiao Guangrong <xiaoguangrong@cn.fujitsu.com>
Acked-by: Gleb Natapov <gleb@redhat.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>

diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
index 100c66ee02203f5646f768ce28bd47c940397be9..74268b4c2ee167932d514281bf6ecc3187462a3e 100644 (file)
--- a/virt/kvm/async_pf.c
+++ b/virt/kvm/async_pf.c
@@ -196,7 +196,7 @@ int kvm_async_pf_wakeup_all(struct kvm_vcpu *vcpu)
 {
        struct kvm_async_pf *work;
 
-       if (!list_empty(&vcpu->async_pf.done))
+       if (!list_empty_careful(&vcpu->async_pf.done))
                return 0;
 
        work = kmem_cache_zalloc(async_pf_cache, GFP_ATOMIC);
@@ -207,7 +207,10 @@ int kvm_async_pf_wakeup_all(struct kvm_vcpu *vcpu)
        get_page(bad_page);
        INIT_LIST_HEAD(&work->queue); /* for list_del to work */
 
+       spin_lock(&vcpu->async_pf.lock);
        list_add_tail(&work->link, &vcpu->async_pf.done);
+       spin_unlock(&vcpu->async_pf.lock);
+
        vcpu->async_pf.queued++;
        return 0;
 }