linux-kernel - Re: [RFC -v4 PATCH 3/3] kvm: use yield_to instead of sleep in kvm_vcpu_on

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 13 Jan 2011 15:16:52 +0200
From:	Avi Kivity <avi@...hat.com>
To:	Rik van Riel <riel@...hat.com>
CC:	kvm@...r.kernel.org, linux-kernel@...r.kernel.org,
	Srivatsa Vaddagiri <vatsa@...ux.vnet.ibm.com>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Mike Galbraith <efault@....de>,
	Chris Wright <chrisw@...s-sol.org>
Subject: Re: [RFC -v4 PATCH 3/3] kvm: use yield_to instead of sleep in kvm_vcpu_on_spin

On 01/13/2011 07:27 AM, Rik van Riel wrote:
> Instead of sleeping in kvm_vcpu_on_spin, which can cause gigantic
> slowdowns of certain workloads, we instead use yield_to to hand
> the rest of our timeslice to another vcpu in the same KVM guest.
>
>

> +	for (pass = 0; pass<  2&&  !yielded; pass++) {
> +		kvm_for_each_vcpu(i, vcpu, kvm) {
> +			struct task_struct *task = vcpu->task;
> +			if (!pass&&  i<  last_boosted_vcpu) {
> +				i = last_boosted_vcpu;
> +				continue;
> +			} else if (pass&&  i>  last_boosted_vcpu)
> +				break;
> +			if (vcpu == me)
> +				continue;
> +			if (!task)
> +				continue;
> +			if (waitqueue_active(&vcpu->wq))
> +				continue;

Suppose the vcpu exits at this point, and its task terminates.

> +			if (task->flags&  PF_VCPU)
> +				continue;

Here you dereference freed memory.

> +			kvm->last_boosted_vcpu = i;
> +			yielded = 1;
> +			yield_to(task, 1);

And here you do unimaginable things to that freed memory.

I think the first patch needs some reference counting... I'd move it to 
the outermost KVM_RUN loop to reduce the performance impact.

> +			break;
> +		}
> +	}
>   }
>   EXPORT_SYMBOL_GPL(kvm_vcpu_on_spin);

-- 
error compiling committee.c: too many arguments to function

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/