search for: wqh

...7:28, Darren Kenny wrote: > Hi Jason, > > On Tue, Mar 27, 2018 at 11:47:22AM +0800, Jason Wang wrote: >> We tried to remove vq poll from wait queue, but do not check whether >> or not it was in a list before. This will lead double free. Fixing >> this by checking poll->wqh to make sure it was in a list. > > This text seems at odds with the code below, instead of checking > poll-whq, you are removing that check... > > Maybe the text needs rewording? Yes, I admit it's bad, thanks for pointing out. How about: "Fixing this by switching to use v...

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at syzkaller.appspotmail.com Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off...

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at syzkaller.appspotmail.com Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off...

This is an update version of last version to fix the handling of polling errors in vhost/vhost_net. Currently, vhost and vhost_net ignore polling errors which can lead kernel crashing when it tries to remove itself from waitqueue after the polling failure. Fix this by checking the poll->wqh before the removing and report an error when meet polling errors. Changes from v2: - check poll->wqh instead of the wrong assumption about POLLERR and waitqueue - drop the whole tx polling state check since it was replaced by the wqh checking - drop the buggy tuntap patch Changes from v1: -...

This is an update version of last version to fix the handling of polling errors in vhost/vhost_net. Currently, vhost and vhost_net ignore polling errors which can lead kernel crashing when it tries to remove itself from waitqueue after the polling failure. Fix this by checking the poll->wqh before the removing and report an error when meet polling errors. Changes from v2: - check poll->wqh instead of the wrong assumption about POLLERR and waitqueue - drop the whole tx polling state check since it was replaced by the wqh checking - drop the buggy tuntap patch Changes from v1: -...

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by checking poll->wqh to make sure it was in a list. Reported-by: syzbot+c0272972b01b872e604a at syzkaller.appspotmail.com Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/vhost.c | 3 +-- 1 file changed,...

On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote: > We tried to remove vq poll from wait queue, but do not check whether > or not it was in a list before. This will lead double free. Fixing > this by switching to use vhost_poll_stop() which zeros poll->wqh after > removing poll from waitqueue to make sure it won't be freed twice. > > Cc: Darren Kenny <darren.kenny at oracle.com> > Reported-by: syzbot+c0272972b01b872e604a at syzkaller.appspotmail.com > Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting...

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60 ++++++++---------------------------------------- drivers/vhost/vhos...

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60 ++++++++---------------------------------------- drivers/vhost/vhos...

...mething like >> that? > > - -- Steffen Kaiser -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEVAwUBVQLyJXz1H7kL/d9rAQK7YggAtWJz0FEylF3I8r7qUZsRjraPuXcHUAHM bDGkrr/9BVUTeFF+wVK51k8iBBb7P2VJo8tefJ1gho00gfJpZo2EE8VG/LEt2LeH chq7v8iCNBaTRMXLlQwzUMii5JjSfoKuFRFEhphuv0yLacWT5AICPiqTqrLz+wQh UW7KMfxZuXDxR4zNj58Da8HQmiTSNm7BQv4N1GpExkGNxcE14X7By4iPFxkKq1OI O24iPL1WSwwhOftdBGuXFO2oCOqIQKHu/aZdoElezobxlNXgegDMk6ui9LPu9V1T 44IF1sICPEjpQyf7SgEvJcpBarXeaUy2NtZGMkWHWU0LNl5XQrETcA== =OGb3 -----END PGP SIGNATURE-----

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to Michael's suggestion. Netperf test shows almost the same result in strea...

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to Michael's suggestion. Netperf test shows almost the same result in strea...

Recent debugging on vhost net zerocopy shows the need of tracepoints. So to help in vhost{net} debugging and performance analyzing, the following series adding basic tracepoints to vhost. Operations of both vhost and vhost_net were traced in current implementation. A top-like satistics displaying script were introduced to help the troubleshooting: vhost statistics vhost_virtio_update_used_idx

Recent debugging on vhost net zerocopy shows the need of tracepoints. So to help in vhost{net} debugging and performance analyzing, the following series adding basic tracepoints to vhost. Operations of both vhost and vhost_net were traced in current implementation. A top-like satistics displaying script were introduced to help the troubleshooting: vhost statistics vhost_virtio_update_used_idx

To help in vhost analyzing, the following series adding basic tracepoints to vhost. Operations of both virtqueues and vhost works were traced in current implementation, net code were untouched. A top-like satistics displaying script were introduced to help the troubleshooting. TODO: - net specific tracepoints? --- Jason Wang (2): vhost: basic tracepoints tools: virtio: add a

To help in vhost analyzing, the following series adding basic tracepoints to vhost. Operations of both virtqueues and vhost works were traced in current implementation, net code were untouched. A top-like satistics displaying script were introduced to help the troubleshooting. TODO: - net specific tracepoints? --- Jason Wang (2): vhost: basic tracepoints tools: virtio: add a

...> >> Cc: Wei Xu <wexu at redhat.com> >> Cc: Matthew Rosato <mjrosato at linux.vnet.ibm.com> >> Signed-off-by: Jason Wang <jasowang at redhat.com> >> --- > Now that vhost_poll_stop happens on data path > a lot, I'd say > if (poll->wqh) > there should be unlikely(). It has been there since 8241a1e466cd ("vhost_net: stop polling socket during rx processing"). So it will be used for rx path too which unlikely() does not work as well as the case in tx. > > >> drivers/vhost/net.c | 11 ++++++++--- >&...

...> >> Cc: Wei Xu <wexu at redhat.com> >> Cc: Matthew Rosato <mjrosato at linux.vnet.ibm.com> >> Signed-off-by: Jason Wang <jasowang at redhat.com> >> --- > Now that vhost_poll_stop happens on data path > a lot, I'd say > if (poll->wqh) > there should be unlikely(). It has been there since 8241a1e466cd ("vhost_net: stop polling socket during rx processing"). So it will be used for rx path too which unlikely() does not work as well as the case in tx. > > >> drivers/vhost/net.c | 11 ++++++++--- >&...

...init_waitqueue_func_entry(&poll->wait, vhost_poll_wakeup); > > init_poll_funcptr(&poll->table, vhost_poll_func); > > @@ -194,6 +194,7 @@ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn, > > poll->dev = dev; > > poll->wqh = NULL; > > > > + poll->poll_id = poll_id; > > vhost_work_init(&poll->work, fn); > > } > > EXPORT_SYMBOL_GPL(vhost_poll_init); > > @@ -276,8 +277,16 @@ bool vhost_has_work(struct vhost_dev *dev) > > } > > EXPORT_SYMBOL_GPL(...

...eventfd.c b/fs/eventfd.c index 8d0c0df..5c0a22f 100644 --- a/fs/eventfd.c +++ b/fs/eventfd.c @@ -59,8 +59,9 @@ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n) if (ULLONG_MAX - ctx->count < n) n = ULLONG_MAX - ctx->count; ctx->count += n; - if (waitqueue_active(&ctx->wqh)) + if (waitqueue_active(&ctx->wqh)) { wake_up_locked_poll(&ctx->wqh, POLLIN); + } spin_unlock_irqrestore(&ctx->wqh.lock, flags); return n; diff --git a/include/uapi/linux/vhost.h b/include/uapi/linux/vhost.h index ab373191..5c35ab4 100644 --- a/include/uapi/linux/vhos...