> reinit after wait, so the chance for missing wakeup still exists. Can you please provide more details on this? Yes, it is reinit after wait, but wait should not be concurrent. I checked multiple code pathes towards vhost_net_flush(), they're all protected by device mutex, except vhost_net_release(). In case of vhost_net_release() - it would be a problem itself if it was called in parallel with some ioctl on a device? Also rationale for this is that put_and_wait() is waiting for zero refcount condition. Zero refcount means that after put_and_wait() calling thread is the only owner of an ubufs structure. If multiple threads got ubufs structure with zero refcount - how either thread can be sure that another one is not free'ing it?