diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2017-12-04 14:22:11 +0000 |
|---|---|---|
| committer | Michael Roth <mdroth@linux.vnet.ibm.com> | 2018-01-29 08:27:35 -0600 |
| commit | 9327a8e2d639370960c1dc3e11ff5d9c2b26174c (patch) | |
| tree | 2713ca1b1e193fa57267294fc74fa141d9264cfd /linux-user | |
| parent | 8ebfafa796ca0cb2b035a7f06f836a675d8b48be (diff) | |
linux-user: Fix locking order in fork_start()
Our locking order is that the tb lock should be taken
inside the mmap_lock, but fork_start() grabs locks the
other way around. This means that if a heavily multithreaded
guest process (such as Java) calls fork() it can deadlock,
with the thread that called fork() stuck in fork_start()
with the tb lock and waiting for the mmap lock, but some
other thread in tb_find() with the mmap lock and waiting
for the tb lock. The cpu_list_lock() should also always be
taken last, not first.
Fix this by making fork_start() grab the locks in the
right order. The order in which we drop locks doesn't
matter, so we leave fork_end() the way it is.
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-stable@nongnu.org
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <1512397331-15238-1-git-send-email-peter.maydell@linaro.org>
Signed-off-by: Laurent Vivier <laurent@vivier.eu>
(cherry picked from commit 024949caf32805f4cc3e7d363a80084b47aac1f6)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Diffstat (limited to 'linux-user')
| -rw-r--r-- | linux-user/main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/linux-user/main.c b/linux-user/main.c index 6286661bd3..146ee3e4ba 100644 --- a/linux-user/main.c +++ b/linux-user/main.c @@ -128,9 +128,9 @@ int cpu_get_pic_interrupt(CPUX86State *env) /* Make sure everything is in a consistent state for calling fork(). */ void fork_start(void) { - cpu_list_lock(); - qemu_mutex_lock(&tb_ctx.tb_lock); mmap_fork_start(); + qemu_mutex_lock(&tb_ctx.tb_lock); + cpu_list_lock(); } void fork_end(int child) |