Received-SPF: pass (google.com: domain of linux-kernel+bounces-164362-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <b959b82a-510f-45c0-9e06-acf526c2f4a1@oracle.com>
Date: Tue, 30 Apr 2024 11:23:04 -0500
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH next] vhost_task: after freeing vhost_task it should not
 be accessed in vhost_task_fn
To: Edward Adam Davis <eadavis@qq.com>,
        syzbot+98edc2df894917b3431f@syzkaller.appspotmail.com
Cc: jasowang@redhat.com, kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
        mst@redhat.com, netdev@vger.kernel.org,
        syzkaller-bugs@googlegroups.com, virtualization@lists.linux.dev
References: <000000000000a9613006174c1c4c@google.com>
 <tencent_4271296B83A6E4413776576946DAB374E305@qq.com>
Content-Language: en-US
From: Mike Christie <michael.christie@oracle.com>
In-Reply-To: <tencent_4271296B83A6E4413776576946DAB374E305@qq.com>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?ZXB3dUxxUS9lcDNndzlnNjI2akN1Y081V2lKQ1BBYWJvQVRzWG9WYmxGU3FS?=
 =?utf-8?B?SGp0WXVvcm9UZUR5N1ViZlZxMkRQUzNENk9QVm9ZdW5WSnNVbTRwNFA5cm9Y?=
 =?utf-8?B?RlU2ZzdlZ1M2QUxBSnNHMEowcks5NmUwQ0gxWWF3dkZNaUtGNTgrWlgzdmlx?=
 =?utf-8?B?NkpiSzBidm5KM2ZjQzBBMVZuR3lzWjV2RTFwL2FoZHM4YURmQjZxR0ZMd3lq?=
 =?utf-8?B?aXp6d05jV0tLUEh2cmoxQkJBUzhXMEVNTFJ2QkFMZDkyZm5xSUhtd2FtTk0w?=
 =?utf-8?B?emZ6UndwR21nY3ZrUXpvWkZHSVgrSHFDNVJBSDZLemxnZ2JWSnBISmdkWFg3?=
 =?utf-8?B?Z1p4VFBHOUFQRHd6d1hSSjc1cjhNUjN5NkE4OTQrcjRQRlZTRDZSVFYvUWF4?=
 =?utf-8?B?MEVHQnlqZE9nVExoSm9teUF2eUlaQmJFelZvTlVGWjRSdWtuRmtwQ0VUbWtl?=
 =?utf-8?B?YnAzclRwR1UwRHE5S3BOY2ZMUVorb2tUeHlQQ3pkSTZNZDNVNkZlbXk1ZEI3?=
 =?utf-8?B?QUdlaFRoSk4xU0Z0cEhGd0JsbTdHWGlUeXd6ZERTaGJ5NHptMVowTDR0emk0?=
 =?utf-8?B?amJUSmR1T2E4ZUxZSkV6b3lwRGpxYlRTalA2OWhUQjJVcWlnL0JhNnRub29B?=
 =?utf-8?B?THRJYWF5VHlRaUxHa3JEMnJCR3N6L2ZkN0Zsci9TdTJGNS9YOVNuSjQwY3BV?=
 =?utf-8?B?bjl3QStlT2ZTTWMxUU5mcFhhYTZrVGorNjRPWUhpVkRCT0hXS2wrQ1VnZjJl?=
 =?utf-8?B?azRyZWhjRmUwRHF4WDY4Rll3ZTJ6eXJYbnFGdzFVbUxFR21vQk1LMWNBanEw?=
 =?utf-8?B?WkRrL08zRDlZOXFxaU5HK1JFNUxab1FRcTZPMThvMS9vMCtpTE5rcnlzZlZm?=
 =?utf-8?B?dVJ1NGJ3L2ZiZzNsMUttc2l3cnBpOHhqK1hwK0F4cC9lNDdpRHZWRFpzS2lz?=
 =?utf-8?B?ZEtyY3NReVNZVVpya1NRT00rQUVOYUF4d2tKeEZMVlNrV3JVUkUzb0JyQ1JF?=
 =?utf-8?B?andHK1hDcGlnZUZjKzBQc3NEcVpvN2J1NkNUR3BxZE5aNUNzMWw2RVUyR1NY?=
 =?utf-8?B?eldTUVJXYXdSeVpGeGJ0Z2ZjbXBvZElVYTN6U2VhYVVhVlI0QS9NdVhHOWpj?=
 =?utf-8?B?ZXB0NlYwNGEwUEV6WGZUNHRScGl4TzRIdVpPZldzNGdSYjh4VmNaOWM0OFVa?=
 =?utf-8?B?YUNua0lVazZkNzBSZERHZThBcm1rQ2RIbU5EaDVrMUtVSitTTzJ6NkJJV3E3?=
 =?utf-8?B?TEdkblFCSmVtRDBDOWxVVHNOWXhPV0ZOR2ErZXZ2RTVOdU1MY0ZjUkFtRWxX?=
 =?utf-8?B?cU1lUUtXQ0ptZWhtQTdHQzBGYjdWUzJ3akx6cm9FRUNqNjBMU3VPSm00bnpy?=
 =?utf-8?B?Z0R6NG9MdktHckFvQjI0aHo4WlJ2K3ZDb1ltRmtxVkIzd2dLdjFTUzM2K3o1?=
 =?utf-8?B?RkNHalhxY21HajVvNThiS2dLN2thRzgvQ3lUbXRKS1F1UGdOOFhEbnRhNkJi?=
 =?utf-8?B?clB5UzZ5SGRRNXdscTJuUDlPT1JCOEJlZDBhUnIxY3hPYkUzVWR1ZFA4RWR0?=
 =?utf-8?B?d3dMY3Fwc0pUUmt1T0tRdXFmeVZnOWZwNWUxcWQ0cnkxeWFUVXJDTkNRSDRK?=
 =?utf-8?B?bG9aWGwwdklaWDNKdndHSG1IZm1FZlNXWjJZMWo3MGNKVXZpbyt4Zkk3by9V?=
 =?utf-8?B?U055MVJFQVZKTUlKODh1Q01yOG5tQm9jeUlCdll0Rk85clRTQXZjK3FnaHhs?=
 =?utf-8?B?Sm1sZkd1RlhrOWJuK2xROThlQllVRlZWRjdIWlJyTUJzVWl1KzBtUEI1eksr?=
 =?utf-8?B?bDFyYnp0VDNOZDZxeXIzT2gvUHRuMjdvMWF4U1dIcGVOTnU4cjY3TkY5eW5i?=
 =?utf-8?B?Zy9Sbnk0ZzJTMTB3dFFFL3pXZ1VwdGhPT0dGY0Z5NHpnZXA0UVNKQzcrQ3d4?=
 =?utf-8?B?SlMyOERJWm9XT3pmK2pmd0ZvYi9JV1o0LytRWk5mVHp3ekc3YllUL1AxWWY1?=
 =?utf-8?B?Y2hVRko0MkFWU0krVW5HbWgyZEtGaXVtTVk3WGRPcmFvclpqUWt4cnB1Z01Z?=
 =?utf-8?B?RTM1R20yWThBaGZwYkh6ajBmQWlOL2paVmJEb25lMlZtS3laM3VjZFdsWm5S?=
 =?utf-8?B?cTRZYnZlenkrUGRtQ2o5QVdkYmV0eVBERTZCcHlvaVBib3MwUHVyblZHNjhQ?=
 =?utf-8?B?b1E9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	Eb0hKEEYMUsr+0Sbg+WKmS2RrdNjPWbp4oMmgMhRRSA46Sa/iIesooN6pY8K2J9EGcKbh/ZRasmhCJVBk0vXaX1X3/PxfZ4jZq8XP+PElc+YZ9/2UR2dHbsCFVt4wDXm+ofFp8fYyEMys213k1E/r1USMe05o8J1fb2fa3tMeqlqERIF+vXOLSe1V/CGZZyhUxL9zbaYmAuHWoyqB37qHwhT65v3HK5uCk7aJiK7xfKJtzY2GahJwnIaflnR7DHySnDNggqJlBWak0LWBjI6u5fHVUTbhmAqHjuwdMTfXoO04HJxBW5nU02RLjkIPNy1SNE2iMwleBAM4VL1KhekaRaQyGnZDan4tMDYjEx9vuiemVyQF0AWybKyNlP+jS7W5f5zug0v+FeF8FcYJl74rCxf/m6LuFL2zWe3nvy7K59AJKn6I6b+GDwQZ81hhGcOdPjZoxnLKZAIwAt8T6VHSlrkKE0MbekEXhymAeBjeTIfvHWlAXksrhKmtkM/qZ66pysSxRv/TlaU5iXfw7UMe6pDheJw7vKCcS3F09/dW66mWkM4x231niA6/89NLiFM020Ty0EpaxxivBka59I6XOiZsnzHzKeMAWmGxlXLD2U=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 6933d01c-03f3-42fc-ff0a-08dc6931d195
X-MS-Exchange-CrossTenant-AuthSource: CY8PR10MB7243.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 Apr 2024 16:23:07.1998
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: fnXwGy7c+9qp0AbgTq+RKRaod4UDF1c19q78AKdr2Ww0Y5brDzI7btC5NbRJBBrQ3IgyEry5DxUsg9Iu6pUXspcaaOO2c/vZ/b9tCO3MR3Q=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PH7PR10MB6602
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1011,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-04-30_09,2024-04-30_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 malwarescore=0
 mlxlogscore=966 bulkscore=0 suspectscore=0 adultscore=0 phishscore=0
 mlxscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2404300116
X-Proofpoint-GUID: 2gaTvJm7JAc2feNsQVmz12u2RfIkURaH
X-Proofpoint-ORIG-GUID: 2gaTvJm7JAc2feNsQVmz12u2RfIkURaH

On 4/30/24 8:05 AM, Edward Adam Davis wrote:
>  static int vhost_task_fn(void *data)
>  {
>  	struct vhost_task *vtsk = data;
> @@ -51,7 +51,7 @@ static int vhost_task_fn(void *data)
>  			schedule();
>  	}
>  
> -	mutex_lock(&vtsk->exit_mutex);
> +	mutex_lock(&exit_mutex);
>  	/*
>  	 * If a vhost_task_stop and SIGKILL race, we can ignore the SIGKILL.
>  	 * When the vhost layer has called vhost_task_stop it's already stopped
> @@ -62,7 +62,7 @@ static int vhost_task_fn(void *data)
>  		vtsk->handle_sigkill(vtsk->data);
>  	}
>  	complete(&vtsk->exited);
> -	mutex_unlock(&vtsk->exit_mutex);
> +	mutex_unlock(&exit_mutex);
>  

Edward, thanks for the patch. I think though I just needed to swap the
order of the calls above.

Instead of:

complete(&vtsk->exited);
mutex_unlock(&vtsk->exit_mutex);

it should have been:

mutex_unlock(&vtsk->exit_mutex);
complete(&vtsk->exited);

If my analysis is correct, then Michael do you want me to resubmit a
patch on top of your vhost branch or resubmit the entire patchset?