commit c2cba0ffe495b60c4cc58080281e99c7a6580d4b
author Fam Zheng <famz@redhat.com> Mon Mar 16 17:03:33 2015 +0800
committer Paolo Bonzini <pbonzini@redhat.com> Mon Apr 27 18:24:17 2015 +0200
tree 37d92a455884260149a2b832892de849a7037aa2
parent e3a0abfda71db1fa83be894dcff7c4871b36cc8d

exec: Atomic access to bounce buffer

There could be a race condition when two processes call
address_space_map concurrently and both want to use the bounce buffer.

Add an in_use flag in BounceBuffer to sync it.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-Id: <1426496617-10702-2-git-send-email-famz@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

exec.c

diff --git a/exec.c b/exec.c
index 874ecfc..5a1c700 100644
--- a/exec.c
+++ b/exec.c
@@ -2482,6 +2482,7 @@
     void *buffer;
     hwaddr addr;
     hwaddr len;
+    bool in_use;
 } BounceBuffer;
 
 static BounceBuffer bounce;
@@ -2570,7 +2571,7 @@
     l = len;
     mr = address_space_translate(as, addr, &xlat, &l, is_write);
     if (!memory_access_is_direct(mr, is_write)) {
-        if (bounce.buffer) {
+        if (atomic_xchg(&bounce.in_use, true)) {
             return NULL;
         }
         /* Avoid unbounded allocations */
@@ -2640,6 +2641,7 @@
     qemu_vfree(bounce.buffer);
     bounce.buffer = NULL;
     memory_region_unref(bounce.mr);
+    atomic_mb_set(&bounce.in_use, false);
     cpu_notify_map_clients();
 }