From 029c84d2efbebc02a4e9a6ee9a3a94289ca36f72 Mon Sep 17 00:00:00 2001 From: David Vrabel Date: Fri, 15 Nov 2013 10:59:41 +0100 Subject: [PATCH] kexec: fix kexec_lock use in kexec_swap_images() CID 1128573 If a bad image type is supplied in a KEXECOP_unload hypercall, the kexec_lock in kexec_swap_images() was left locked, causing a deadlock on a subsequent image load or unload. The kexec_lock is only required to serialize the swap operation itself. Signed-off-by: David Vrabel Reviewed-by: Andrew Cooper --- xen/common/kexec.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/xen/common/kexec.c b/xen/common/kexec.c index 9999babce6..17f3ed793d 100644 --- a/xen/common/kexec.c +++ b/xen/common/kexec.c @@ -785,17 +785,14 @@ static int kexec_swap_images(int type, struct kexec_image *new, *old = NULL; - spin_lock(&kexec_lock); - if ( test_bit(KEXEC_FLAG_IN_PROGRESS, &kexec_flags) ) - { - spin_unlock(&kexec_lock); return -EBUSY; - } if ( kexec_load_get_bits(type, &base, &bit) ) return -EINVAL; + spin_lock(&kexec_lock); + pos = (test_bit(bit, &kexec_flags) != 0); old_slot = base + pos; new_slot = base + !pos; -- 2.39.5