diff options
| author | Richard Henderson | 2022-08-19 03:03:52 +0200 |
|---|---|---|
| committer | Richard Henderson | 2022-08-19 03:08:57 +0200 |
| commit | 976a55c0fe427a0084823152447cf5bb9092d24f (patch) | |
| tree | 09c6a83d7d3d2ea5b4c9f6d665ee90930ecf753e /linux-user | |
| parent | Merge tag 'fixes-pull-request' of gitlab.com:marcandre.lureau/qemu into staging (diff) | |
| download | qemu-976a55c0fe427a0084823152447cf5bb9092d24f.tar.gz qemu-976a55c0fe427a0084823152447cf5bb9092d24f.tar.xz qemu-976a55c0fe427a0084823152447cf5bb9092d24f.zip | |
Revert "linux-user: un-parent OBJECT(cpu) when closing thread"
This reverts commit 52f0c1607671293afcdb2acc2f83e9bccbfa74bb.
This caused a regression in arm/aarch64.
We are hard-coding ARMCPRegInfo pointers into TranslationBlocks,
for calling into helper_{get,set}cp_reg{,64}. So we have a race
condition between whichever cpu thread translates the code first
(encoding the pointer), and that cpu thread exiting, so that the
next execution of the TB references a freed data structure.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'linux-user')
| -rw-r--r-- | linux-user/syscall.c | 13 |
1 files changed, 6 insertions, 7 deletions
diff --git a/linux-user/syscall.c b/linux-user/syscall.c index bfdd60136b..f409121202 100644 --- a/linux-user/syscall.c +++ b/linux-user/syscall.c @@ -8594,13 +8594,7 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, if (CPU_NEXT(first_cpu)) { TaskState *ts = cpu->opaque; - if (ts->child_tidptr) { - put_user_u32(0, ts->child_tidptr); - do_sys_futex(g2h(cpu, ts->child_tidptr), - FUTEX_WAKE, INT_MAX, NULL, NULL, 0); - } - - object_unparent(OBJECT(cpu)); + object_property_set_bool(OBJECT(cpu), "realized", false, NULL); object_unref(OBJECT(cpu)); /* * At this point the CPU should be unrealized and removed @@ -8610,6 +8604,11 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1, pthread_mutex_unlock(&clone_lock); + if (ts->child_tidptr) { + put_user_u32(0, ts->child_tidptr); + do_sys_futex(g2h(cpu, ts->child_tidptr), + FUTEX_WAKE, INT_MAX, NULL, NULL, 0); + } thread_cpu = NULL; g_free(ts); rcu_unregister_thread(); |