On 2018年03月29日 12:20, Michael S. Tsirkin wrote:
On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote:We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny<darren.kenny@xxxxxxxxxx> Reported-by:syzbot+c0272972b01b872e604a@xxxxxxxxxxxxxxxxxxxxxxxxx Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off-by: Jason Wang<jasowang@xxxxxxxxxx>OK with this the only bug we have is where get user pages returns 0 (Reported-by:syzbot+6304bf97ef436580fede@xxxxxxxxxxxxxxxxxxxxxxxxx)
Thanks for the reminder. I post a patch to avoid this.
