All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Michael S. Tsirkin" <mst@redhat.com>
To: Mike Christie <michael.christie@oracle.com>
Cc: Edward Adam Davis <eadavis@qq.com>,
	syzbot+98edc2df894917b3431f@syzkaller.appspotmail.com,
	jasowang@redhat.com, kvm@vger.kernel.org,
	linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
	syzkaller-bugs@googlegroups.com, virtualization@lists.linux.dev
Subject: Re: [PATCH next] vhost_task: after freeing vhost_task it should not be accessed in vhost_task_fn
Date: Tue, 30 Apr 2024 14:06:33 -0400	[thread overview]
Message-ID: <20240430140613-mutt-send-email-mst@kernel.org> (raw)
In-Reply-To: <b959b82a-510f-45c0-9e06-acf526c2f4a1@oracle.com>

On Tue, Apr 30, 2024 at 11:23:04AM -0500, Mike Christie wrote:
> On 4/30/24 8:05 AM, Edward Adam Davis wrote:
> >  static int vhost_task_fn(void *data)
> >  {
> >  	struct vhost_task *vtsk = data;
> > @@ -51,7 +51,7 @@ static int vhost_task_fn(void *data)
> >  			schedule();
> >  	}
> >  
> > -	mutex_lock(&vtsk->exit_mutex);
> > +	mutex_lock(&exit_mutex);
> >  	/*
> >  	 * If a vhost_task_stop and SIGKILL race, we can ignore the SIGKILL.
> >  	 * When the vhost layer has called vhost_task_stop it's already stopped
> > @@ -62,7 +62,7 @@ static int vhost_task_fn(void *data)
> >  		vtsk->handle_sigkill(vtsk->data);
> >  	}
> >  	complete(&vtsk->exited);
> > -	mutex_unlock(&vtsk->exit_mutex);
> > +	mutex_unlock(&exit_mutex);
> >  
> 
> Edward, thanks for the patch. I think though I just needed to swap the
> order of the calls above.
> 
> Instead of:
> 
> complete(&vtsk->exited);
> mutex_unlock(&vtsk->exit_mutex);
> 
> it should have been:
> 
> mutex_unlock(&vtsk->exit_mutex);
> complete(&vtsk->exited);
> 
> If my analysis is correct, then Michael do you want me to resubmit a
> patch on top of your vhost branch or resubmit the entire patchset?

Resubmit all please.

-- 
MST


  reply	other threads:[~2024-04-30 18:06 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-04-30  8:25 [syzbot] [net?] [virt?] [kvm?] KASAN: slab-use-after-free Read in vhost_task_fn syzbot
2024-04-30  9:31 ` Edward Adam Davis
2024-04-30 11:09   ` syzbot
2024-05-01 20:33   ` Michael S. Tsirkin
2024-04-30 11:02 ` Hillf Danton
2024-04-30 15:47   ` syzbot
2024-04-30 11:57 ` Edward Adam Davis
2024-04-30 15:34   ` syzbot
2024-04-30 13:05 ` [PATCH next] vhost_task: after freeing vhost_task it should not be accessed " Edward Adam Davis
2024-04-30 16:23   ` Mike Christie
2024-04-30 18:06     ` Michael S. Tsirkin [this message]
2024-05-01  0:15     ` Hillf Danton
2024-05-01  1:01       ` Mike Christie
2024-05-01  5:52         ` Michael S. Tsirkin
2024-05-01  6:01       ` Michael S. Tsirkin
2024-05-01  7:50         ` Hillf Danton
2024-05-01 15:57           ` Mike Christie
2024-05-01 16:04             ` Michael S. Tsirkin
2024-05-01 16:15             ` Michael S. Tsirkin
2024-04-30 22:50 ` [syzbot] [net?] [virt?] [kvm?] KASAN: slab-use-after-free Read " Hillf Danton
2024-04-30 23:21   ` syzbot
2024-05-01  3:44 ` Edward Adam Davis
2024-05-01 10:13   ` syzbot
2024-05-01 16:12 ` Michael S. Tsirkin
2024-05-01 16:56   ` syzbot
2024-05-05  3:07 ` Edward Adam Davis
2024-05-05  3:40   ` syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240430140613-mutt-send-email-mst@kernel.org \
    --to=mst@redhat.com \
    --cc=eadavis@qq.com \
    --cc=jasowang@redhat.com \
    --cc=kvm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=michael.christie@oracle.com \
    --cc=netdev@vger.kernel.org \
    --cc=syzbot+98edc2df894917b3431f@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --cc=virtualization@lists.linux.dev \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.