@samitouri / QOSamiQemu / commits / 4878c3a43a

qemu-coroutine-lock: fix has_waiters()

has_waiters() is testing a reversed condition. The logic is that has_waiters() must return true if a qemu_co_mutex_lock_slowpath() happened: qemu_co_mutex_unlock qemu_co_mutex_lock_slowpath ------------------------- ------------------------------- set handoff push to from_push memory barrier memory barrier check has_waiters() check handoff which requires it to return true if from_push (or to_pop from a previous call) are *not* empty. This was unlikely to cause trouble because it can only happen when the same CoMutex is used across multiple threads, but it is nevertheless completely wrong. The bug would show up as either a NULL-pointer dereference inside qemu_co_mutex_lock_slowpath(), or a missed wait in qemu_co_mutex_unlock(). Reported-by: Siteshwar Vashisht <svashisht@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Paolo Bonzini committed Mar 2, 2026 at 14:06 UTC 4878c3a43abef0a04ac95dec282aaf347efd529b

1 file changed +1 -1

util/qemu-coroutine-lock.c

+1 -1

@@ -173,7 +173,7 @@ static CoWaitRecord *pop_waiter(CoMutex *mutex)

173

174 static bool has_waiters(CoMutex *mutex)

175 {

176 - return QSLIST_EMPTY(&mutex->to_pop) || QSLIST_EMPTY(&mutex->from_push);

176 + return !QSLIST_EMPTY(&mutex->to_pop) || !QSLIST_EMPTY(&mutex->from_push);

177 }

178

179 void qemu_co_mutex_init(CoMutex *mutex)