Jason Wang 0445d2c3f6 vhost: correctly remove wait queue during poll failure ...

[ Upstream commit dc6455a71c ]

We tried to remove vq poll from wait queue, but do not check whether
or not it was in a list before. This will lead double free. Fixing
this by switching to use vhost_poll_stop() which zeros poll->wqh after
removing poll from waitqueue to make sure it won't be freed twice.

Cc: Darren Kenny <darren.kenny@oracle.com>
Reported-by: syzbot+c0272972b01b872e604a@syzkaller.appspotmail.com
Fixes: 2b8b328b61 ("vhost_net: handle polling errors when setting backend")
Signed-off-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-04-13 19:50:25 +02:00

..

Kconfig

vhost: cross-endian support for legacy devices

2015-06-01 15:48:55 +02:00

Makefile

vhost: Make vhost a separate module

2013-07-07 17:33:44 +03:00

net.c

vhost_net: stop device during reset owner

2018-02-16 20:09:38 +01:00

scsi.c

fix a page leak in vhost_scsi_iov_to_sgl() error recovery

2017-11-30 08:37:22 +00:00

test.c

vhost: move features to core

2015-09-16 12:48:07 +03:00

test.h

vhost test module

2010-12-09 16:00:21 +02:00

vhost.c

vhost: correctly remove wait queue during poll failure

2018-04-13 19:50:25 +02:00

vhost.h

vhost: fix performance on LE hosts

2015-10-27 20:17:03 -07:00

vringh.c

vringh: update for virtio 1.0 APIs

2014-12-15 23:49:28 +02:00