Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753916AbdG3HCS (ORCPT ); Sun, 30 Jul 2017 03:02:18 -0400 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:49883 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752309AbdG3HCQ (ORCPT ); Sun, 30 Jul 2017 03:02:16 -0400 From: Mike Rapoport To: Andrew Morton Cc: Andrea Arcangeli , "Dr. David Alan Gilbert" , Pavel Emelyanov , linux-mm , lkml , Mike Rapoport , stable@vger.kernel.org Subject: [PATCH] userfaultfd: non-cooperative: flush event_wqh at release time Date: Sun, 30 Jul 2017 10:02:07 +0300 X-Mailer: git-send-email 2.7.4 X-TM-AS-GCONF: 00 x-cbid: 17073007-0016-0000-0000-000004DC6806 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17073007-0017-0000-0000-00002813375E Message-Id: <1501398127-30419-1-git-send-email-rppt@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-07-30_02:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1706020000 definitions=main-1707300122 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 949 Lines: 29 There maybe still threads waiting on event_wqh at the time the userfault file descriptor is closed. Flush the events wait-queue to prevent waiting threads from hanging. Cc: stable@vger.kernel.org Fixes: 9cd75c3cd4c3d ("userfaultfd: non-cooperative: add ability to report non-PF events from uffd descriptor") Signed-off-by: Mike Rapoport --- fs/userfaultfd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 2d8c2d848668..06ea26b8c996 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -854,6 +854,9 @@ static int userfaultfd_release(struct inode *inode, struct file *file) __wake_up_locked_key(&ctx->fault_wqh, TASK_NORMAL, &range); spin_unlock(&ctx->fault_pending_wqh.lock); + /* Flush pending events that may still wait on event_wqh */ + wake_up_all(&ctx->event_wqh); + wake_up_poll(&ctx->fd_wqh, POLLHUP); userfaultfd_ctx_put(ctx); return 0; -- 2.7.4