Re: [PATCH net V2] vhost: correctly remove wait queue during poll failure

[David Miller]

From: Jason Wang <jasowang@xxxxxxxxxx>
Date: Tue, 27 Mar 2018 20:50:52 +0800

> We tried to remove vq poll from wait queue, but do not check whether
> or not it was in a list before. This will lead double free. Fixing
> this by switching to use vhost_poll_stop() which zeros poll->wqh after
> removing poll from waitqueue to make sure it won't be freed twice.
> 
> Cc: Darren Kenny <darren.kenny@xxxxxxxxxx>
> Reported-by: syzbot+c0272972b01b872e604a@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend")
> Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx>
> ---
> Changes from V1:
> - tweak the commit log for to match the code

Applied and queued up for -stable, thank you.