lkml.org 
[lkml]   [2018]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 288/310] vhost: correctly remove wait queue during poll failure
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jason Wang <jasowang@redhat.com>


    [ Upstream commit dc6455a71c7fc5117977e197f67f71b49f27baba ]

    We tried to remove vq poll from wait queue, but do not check whether
    or not it was in a list before. This will lead double free. Fixing
    this by switching to use vhost_poll_stop() which zeros poll->wqh after
    removing poll from waitqueue to make sure it won't be freed twice.

    Cc: Darren Kenny <darren.kenny@oracle.com>
    Reported-by: syzbot+c0272972b01b872e604a@syzkaller.appspotmail.com
    Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend")
    Signed-off-by: Jason Wang <jasowang@redhat.com>
    Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
    Acked-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/vhost/vhost.c | 3 +--
    1 file changed, 1 insertion(+), 2 deletions(-)

    --- a/drivers/vhost/vhost.c
    +++ b/drivers/vhost/vhost.c
    @@ -211,8 +211,7 @@ int vhost_poll_start(struct vhost_poll *
    if (mask)
    vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
    if (mask & POLLERR) {
    - if (poll->wqh)
    - remove_wait_queue(poll->wqh, &poll->wait);
    + vhost_poll_stop(poll);
    ret = -EINVAL;
    }


    \
     
     \ /
      Last update: 2018-04-11 21:10    [W:4.072 / U:0.176 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site