Messages in this thread | | | Subject | Re: [PATCH net V2] vhost: correctly remove wait queue during poll failure | From | Jason Wang <> | Date | Thu, 29 Mar 2018 16:01:44 +0800 |
| |
On 2018年03月29日 12:20, Michael S. Tsirkin wrote: > On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote: >> We tried to remove vq poll from wait queue, but do not check whether >> or not it was in a list before. This will lead double free. Fixing >> this by switching to use vhost_poll_stop() which zeros poll->wqh after >> removing poll from waitqueue to make sure it won't be freed twice. >> >> Cc: Darren Kenny<darren.kenny@oracle.com> >> Reported-by:syzbot+c0272972b01b872e604a@syzkaller.appspotmail.com >> Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") >> Signed-off-by: Jason Wang<jasowang@redhat.com> > OK with this the only bug we have is where get user pages returns 0 > (Reported-by:syzbot+6304bf97ef436580fede@syzkaller.appspotmail.com) > > >
Thanks for the reminder.
I post a patch to avoid this.
| |