[Devel] [PATCH vz10 COMMIT 01/12] epoll: annotate racy check

[Pavel Tikhomirov]

Committed to rh10-6.12.0-211.30.1.14.3.vz10. (for the whole series)

On 7/7/26 16:20, Eva Kurchatova wrote:
> From: Christian Brauner <brauner at kernel.org>
> 
> [ Upstream commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a ]
> 
> Epoll relies on a racy fastpath check during __fput() in
> eventpoll_release() to avoid the hit of pointlessly acquiring a
> semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE().
> 
> Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com
> Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner
> Reviewed-by: Jan Kara <jack at suse.cz>
> Reported-by: syzbot+3b6b32dc50537a49bb4a at syzkaller.appspotmail.com
> Signed-off-by: Christian Brauner <brauner at kernel.org>
> Signed-off-by: Sasha Levin <sashal at kernel.org>
> (cherry picked from commit d222934627b9a9fbd943386988c5f923c95f0773)
> Signed-off-by: Eva Kurchatova <eva.kurchatova at virtuozzo.com>
> 
> https://virtuozzo.atlassian.net/browse/VSTOR-137490
> Feature: fix epoll cve
> ---
>  fs/eventpoll.c            | 6 ++++--
>  include/linux/eventpoll.h | 2 +-
>  2 files changed, 5 insertions(+), 3 deletions(-)
> 
> diff --git a/fs/eventpoll.c b/fs/eventpoll.c
> index f4efb5b19e78..a3c01bba3654 100644
> --- a/fs/eventpoll.c
> +++ b/fs/eventpoll.c
> @@ -852,7 +852,8 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
>  	to_free = NULL;
>  	head = file->f_ep;
>  	if (head->first == &epi->fllink && !epi->fllink.next) {
> -		file->f_ep = NULL;
> +		/* See eventpoll_release() for details. */
> +		WRITE_ONCE(file->f_ep, NULL);
>  		if (!is_file_epoll(file)) {
>  			struct epitems_head *v;
>  			v = container_of(head, struct epitems_head, epitems);
> @@ -1630,7 +1631,8 @@ static int attach_epitem(struct file *file, struct epitem *epi)
>  			spin_unlock(&file->f_lock);
>  			goto allocate;
>  		}
> -		file->f_ep = head;
> +		/* See eventpoll_release() for details. */
> +		WRITE_ONCE(file->f_ep, head);
>  		to_free = NULL;
>  	}
>  	hlist_add_head_rcu(&epi->fllink, file->f_ep);
> diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
> index 3337745d81bd..0c0d00fcd131 100644
> --- a/include/linux/eventpoll.h
> +++ b/include/linux/eventpoll.h
> @@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file)
>  	 * because the file in on the way to be removed and nobody ( but
>  	 * eventpoll ) has still a reference to this file.
>  	 */
> -	if (likely(!file->f_ep))
> +	if (likely(!READ_ONCE(file->f_ep)))
>  		return;
>  
>  	/*

-- 
Best regards, Pavel Tikhomirov
Senior Software Developer, Virtuozzo.