• Michael S. Tsirkin's avatar
    virtio_ring: tag event_triggered as racy for KCSAN · 83c334ed
    Michael S. Tsirkin authored
    Setting event_triggered from the interrupt handler
    is fundamentally racy. There are races of 2 types:
    1. vq processing can read false value while interrupt
       triggered and set it to true.
       result will be a bit of extra work when disabling cbs, no big deal.
    
    1. vq processing can set false value then interrupt
       immediately sets true value
       since interrupt then triggers a callback which will
       process buffers, this is also not an issue.
    
    However, looks like KCSAN can not figure all this out, and warns about
    the race between the write and the read.  Tag the access data_racy for
    now.  We should probably look at ways to make this more
    straight-forwardly correct.
    
    Message-ID: <6bdd771a4fb7625a9227971b3cf4745c34c31a32.1726153334.git.mst@redhat.com>
    Reported-by: syzbot+8a02104389c2e0ef5049@syzkaller.appspotmail.com
    Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    Acked-by: default avatarJason Wang <jasowang@redhat.com>
    Acked-by: default avatarMarco Elver <elver@google.com>
    83c334ed
virtio_ring.c 83 KB