Add a mutex to serialize updates to firewall
The nwfilter conf update mutex previously serialized
updates to the internal data structures for firewall
rules, and updates to the firewall itself. The latter
was recently turned into a read/write lock, and filter
instantiation allowed to proceed in parallel. It was
believed that this was ok, since each filter is created
on a separate iptables/ebtables chain.
It turns out that there is a subtle lock ordering problem
on virNWFilterObjPtr instances. __virNWFilterInstantiateFilter
will hold a lock on the virNWFilterObjPtr it is instantiating.
This in turn invokes virNWFilterInstantiate which then invokes
virNWFilterDetermineMissingVarsRec which then invokes
virNWFilterObjFindByName. This iterates over every single
virNWFilterObjPtr in the list, locking them and checking their
name. So if 2 or more threads try to instantiate a filter in
parallel, they'll all hold 1 lock at the top level in the
__virNWFilterInstantiateFilter method which will cause the
other thread to deadlock in virNWFilterObjFindByName.
The fix is to add an exclusive mutex to serialize the
execution of __virNWFilterInstantiateFilter.
Signed-off-by: NDaniel P. Berrange <berrange@redhat.com>
Showing
-
mentioned in commit ebc7e55c
-
mentioned in commit b7d051af
-
mentioned in commit 78c35ad5
-
mentioned in commit b4aa48c7
-
mentioned in commit 5cf78681
-
mentioned in commit 7ad2a25f
-
mentioned in commit ac903dbd
-
mentioned in commit 034a4d7a
-
mentioned in commit 6e02f55b
-
mentioned in commit 98069ba7
-
mentioned in commit d5a14a1a
-
mentioned in commit df573e50
想要评论请 注册 或 登录