When you send series with many patches, please use cover letter. Also this series belongs to vzlin-dev list.
On 7/7/26 16:20, Eva Kurchatova wrote: > From: Christian Brauner <[email protected]> > > [ Upstream commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a ] > > Epoll relies on a racy fastpath check during __fput() in > eventpoll_release() to avoid the hit of pointlessly acquiring a > semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE(). > > Link: https://lore.kernel.org/r/[email protected] > Link: > https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner > Reviewed-by: Jan Kara <[email protected]> > Reported-by: [email protected] > Signed-off-by: Christian Brauner <[email protected]> > Signed-off-by: Sasha Levin <[email protected]> > (cherry picked from commit d222934627b9a9fbd943386988c5f923c95f0773) > Signed-off-by: Eva Kurchatova <[email protected]> > > https://virtuozzo.atlassian.net/browse/VSTOR-137490 > Feature: fix epoll cve CVE number should be included. > --- > fs/eventpoll.c | 6 ++++-- > include/linux/eventpoll.h | 2 +- > 2 files changed, 5 insertions(+), 3 deletions(-) > > diff --git a/fs/eventpoll.c b/fs/eventpoll.c > index f4efb5b19e78..a3c01bba3654 100644 > --- a/fs/eventpoll.c > +++ b/fs/eventpoll.c > @@ -852,7 +852,8 @@ static bool __ep_remove(struct eventpoll *ep, struct > epitem *epi, bool force) > to_free = NULL; > head = file->f_ep; > if (head->first == &epi->fllink && !epi->fllink.next) { > - file->f_ep = NULL; > + /* See eventpoll_release() for details. */ > + WRITE_ONCE(file->f_ep, NULL); > if (!is_file_epoll(file)) { > struct epitems_head *v; > v = container_of(head, struct epitems_head, epitems); > @@ -1630,7 +1631,8 @@ static int attach_epitem(struct file *file, struct > epitem *epi) > spin_unlock(&file->f_lock); > goto allocate; > } > - file->f_ep = head; > + /* See eventpoll_release() for details. */ > + WRITE_ONCE(file->f_ep, head); > to_free = NULL; > } > hlist_add_head_rcu(&epi->fllink, file->f_ep); > diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h > index 3337745d81bd..0c0d00fcd131 100644 > --- a/include/linux/eventpoll.h > +++ b/include/linux/eventpoll.h > @@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file) > * because the file in on the way to be removed and nobody ( but > * eventpoll ) has still a reference to this file. > */ > - if (likely(!file->f_ep)) > + if (likely(!READ_ONCE(file->f_ep))) > return; > > /* -- Best regards, Pavel Tikhomirov Senior Software Developer, Virtuozzo. _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
