Re: [PATCH net V2] vhost: correctly remove wait queue during poll failure

[Jason Wang]

On 2018å03æ29æ 12:20, Michael S. Tsirkin wrote:
> On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote:
> > We tried to remove vq poll from wait queue, but do not check whether
> > or not it was in a list before. This will lead double free. Fixing
> > this by switching to use vhost_poll_stop() which zeros poll->wqh after
> > removing poll from waitqueue to make sure it won't be freed twice.
> >
> > Cc: Darren Kenny<darren.kenny@xxxxxxxxxx>
> > Reported-by:syzbot+c0272972b01b872e604a@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend")
> > Signed-off-by: Jason Wang<jasowang@xxxxxxxxxx>
> OK with this the only bug we have is where get user pages returns 0
> (Reported-by:syzbot+6304bf97ef436580fede@xxxxxxxxxxxxxxxxxxxxxxxxx)

Thanks for the reminder.

I post a patch to avoid this.