similar to: [PATCH net] vhost: correctly remove wait queue during poll failure

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by switching to use vhost_poll_stop() which zeros poll->wqh after removing poll from waitqueue to make sure it won't be freed twice. Cc: Darren Kenny <darren.kenny at oracle.com> Reported-by: syzbot+c0272972b01b872e604a at

On Tue, Mar 27, 2018 at 08:50:52PM +0800, Jason Wang wrote: > We tried to remove vq poll from wait queue, but do not check whether > or not it was in a list before. This will lead double free. Fixing > this by switching to use vhost_poll_stop() which zeros poll->wqh after > removing poll from waitqueue to make sure it won't be freed twice. > > Cc: Darren Kenny

We tried to remove vq poll from wait queue, but do not check whether or not it was in a list before. This will lead double free. Fixing this by checking poll->wqh to make sure it was in a list. Reported-by: syzbot+c0272972b01b872e604a at syzkaller.appspotmail.com Fixes: 2b8b328b61c79 ("vhost_net: handle polling errors when setting backend") Signed-off-by: Jason Wang <jasowang at

This is an update version of last version to fix the handling of polling errors in vhost/vhost_net. Currently, vhost and vhost_net ignore polling errors which can lead kernel crashing when it tries to remove itself from waitqueue after the polling failure. Fix this by checking the poll->wqh before the removing and report an error when meet polling errors. Changes from v2: - check poll->wqh

This is an update version of last version to fix the handling of polling errors in vhost/vhost_net. Currently, vhost and vhost_net ignore polling errors which can lead kernel crashing when it tries to remove itself from waitqueue after the polling failure. Fix this by checking the poll->wqh before the removing and report an error when meet polling errors. Changes from v2: - check poll->wqh

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 60

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to

After commit 2b8b328b61c799957a456a5a8dab8cc7dea68575 (vhost_net: handle polling errors when setting backend), we in fact track the polling state through poll->wqh, so there's no need to duplicate the work with an extra vhost_net_polling_state. So this patch removes this and make the code simpler. This patch also removes the all tx starting/stopping code in tx path according to

On 2017?11?01? 00:36, Michael S. Tsirkin wrote: > On Tue, Oct 31, 2017 at 06:27:20PM +0800, Jason Wang wrote: >> We always poll tx for socket, this is sub optimal since: >> >> - we only want to be notified when sndbuf is available >> - this will slightly increase the waitqueue traversing time and more >> important, vhost could not benefit from commit >>

On 2017?11?01? 00:36, Michael S. Tsirkin wrote: > On Tue, Oct 31, 2017 at 06:27:20PM +0800, Jason Wang wrote: >> We always poll tx for socket, this is sub optimal since: >> >> - we only want to be notified when sndbuf is available >> - this will slightly increase the waitqueue traversing time and more >> important, vhost could not benefit from commit >>

Fix the leaking of oldubufs and fd refcnt when fail to initialized used ring. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index ebd08b2..629d6b5 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -834,8 +834,10 @@ static

Fix the leaking of oldubufs and fd refcnt when fail to initialized used ring. Signed-off-by: Jason Wang <jasowang at redhat.com> --- drivers/vhost/net.c | 14 +++++++++++--- 1 files changed, 11 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c index ebd08b2..629d6b5 100644 --- a/drivers/vhost/net.c +++ b/drivers/vhost/net.c @@ -834,8 +834,10 @@ static

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

What it is: vhost net is a character device that can be used to reduce the number of system calls involved in virtio networking. Existing virtio net code is used in the guest without modification. There's similarity with vringfd, with some differences and reduced scope - uses eventfd for signalling - structures can be moved around in memory at any time (good for migration) - support memory

Recent debugging on vhost net zerocopy shows the need of tracepoints. So to help in vhost{net} debugging and performance analyzing, the following series adding basic tracepoints to vhost. Operations of both vhost and vhost_net were traced in current implementation. A top-like satistics displaying script were introduced to help the troubleshooting: vhost statistics vhost_virtio_update_used_idx

Recent debugging on vhost net zerocopy shows the need of tracepoints. So to help in vhost{net} debugging and performance analyzing, the following series adding basic tracepoints to vhost. Operations of both vhost and vhost_net were traced in current implementation. A top-like satistics displaying script were introduced to help the troubleshooting: vhost statistics vhost_virtio_update_used_idx