similar to: [PATCH net] vhost: correctly remove wait queue during poll failure

On 2018?03?27? 17:28, Darren Kenny wrote: > Hi Jason, > > On Tue, Mar 27, 2018 at 11:47:22AM +0800, Jason Wang wrote: >> We tried to remove vq poll from wait queue, but do not check whether >> or not it was in a list before. This will lead double free. Fixing >> this by checking poll->wqh to make sure it was in a list. > > This text seems at odds with the code

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at

On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote: > We tried to remove vq poll from wait queue, but do not check whether > or not it was in a list before. This will lead double free. Fixing > this by switching to use vhost_poll_stop() which zeros poll->wqh after > removing poll from waitqueue to make sure it won't be freed twice. > > Cc: Darren Kenny

On 2020/5/26 ??1:32, Zhu Lingshan wrote: > Standard vhost devices rely on waking up a vhost_worker to kick > a virtquque. However vdpa devices have hardware backends, so it > does not need this waking up routin. In this commit, vdpa device > will kick a virtqueue directly, reduce the performance overhead > caused by waking up a vhost_woker. Thanks for the patch. It would be

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to

On 2018?03?24? 20:32, syzbot wrote: > syzbot has found reproducer for the following crash on upstream commit > 99fec39e7725d091c94d1bb0242e40c8092994f6 (Fri Mar 23 22:34:18 2018 +0000) > Merge tag 'trace-v4.16-rc4' of > git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace > syzbot dashboard link: >

Since 2.6.36-rc1, non-root users of vhost-net fail to attach if they are in any cgroups. This is a regression, and libvirt actually uses this functionality, as it runs qemu with reduced priveledges. The bug is that when qemu uses vhost, vhost wants to attach its thread to all cgroups that qemu has. But we got the API backwards, so a non-priveledged process (qemu) tried to control the priveledged

Since 2.6.36-rc1, non-root users of vhost-net fail to attach if they are in any cgroups. This is a regression, and libvirt actually uses this functionality, as it runs qemu with reduced priveledges. The bug is that when qemu uses vhost, vhost wants to attach its thread to all cgroups that qemu has. But we got the API backwards, so a non-priveledged process (qemu) tried to control the priveledged

On Tue, Aug 21, 2018 at 8:45 AM Jason Wang <jasowang at redhat.com> wrote: > > > > On 2018?08?19? 20:11, xiangxia.m.yue at gmail.com wrote: > > From: Tonghao Zhang <xiangxia.m.yue at gmail.com> > > > > The bitmap of vhost_dev can help us to check if the > > specified poll is scheduled. This patch will be used > > for next two patches. > >

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

I saw WARN_ON(!list_empty(&dev->work_list)) trigger so our custom flush is not as airtight as need be. This patch switches to a simple atomic counter + srcu instead of the custom locked queue + flush implementation. This will slow down the setup ioctls, which should not matter - it's slow path anyway. We use the expedited flush to at least make sure it has a sane time bound. Works

I saw WARN_ON(!list_empty(&dev->work_list)) trigger so our custom flush is not as airtight as need be. This patch switches to a simple atomic counter + srcu instead of the custom locked queue + flush implementation. This will slow down the setup ioctls, which should not matter - it's slow path anyway. We use the expedited flush to at least make sure it has a sane time bound. Works

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration, bug work-arounds