In the Linux kernel, the following vulnerability has been resolved: vduse: Fix race in...

In the Linux kernel, the following vulnerability has been resolved:

vduse: Fix race in vduse_dev_msg_sync and vduse_dev_read_iter

There is one race case in vduse_dev_msg_sync and vduse_dev_read_iter:

vduse_dev_read_iter(): lock(msg_lock); dequeue_msg(send_list); unlock(msg_lock); vduse_dev_msg_sync(): wait_timeout() finish lock(msg_lock); check msg->complete is false list_del(msg); <- double list_del() crash!

To fix this case, we shall ensure vduse_msg is on send_list or recv_list outside the msg_lock critical section.