Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Sun, 27 Mar 2022 10:15:30 -0700
From:   Davidlohr Bueso <dave@stgolabs.net>
To:     Kuniyuki Iwashima <kuniyu@amazon.co.jp>
Cc:     Andrew Morton <akpm@linux-foundation.org>,
        Al Viro <viro@zeniv.linux.org.uk>,
        Kuniyuki Iwashima <kuni1840@gmail.com>,
        linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
        syzbot+19480160ef25c9ffa29d@syzkaller.appspotmail.com,
        Soheil Hassas Yeganeh <soheil@google.com>,
        Sridhar Samudrala <sridhar.samudrala@intel.com>,
        Alexander Duyck <alexander.h.duyck@intel.com>
Subject: Re: [PATCH] list: Fix another data-race around ep->rdllist.
Message-ID: <20220327171530.sbx63nw7h72bjucw@offworld>
References: <20220326063558.89906-1-kuniyu@amazon.co.jp>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Disposition: inline
In-Reply-To: <20220326063558.89906-1-kuniyu@amazon.co.jp>
User-Agent: NeoMutt/20201120
Precedence: bulk

On Sat, 26 Mar 2022, Kuniyuki Iwashima wrote:

>syzbot had reported another race around ep->rdllist.  ep_poll() calls
>list_empty_careful() locklessly to check if the list is empty or not
>by testing rdllist->prev == rdllist->next.
>
>When the list does not have any nodes, the next and prev arguments of
>__list_add() is the same head pointer.  Thus the write to head->prev
>there is racy with lockless list_empty_careful() and needs WRITE_ONCE()
>to avoid store-tearing.
>
>Note that the reader side is already fixed in the patch [0].
>
>[0]: https://lore.kernel.org/mm-commits/20220326031647.DD24EC004DD@smtp.kernel.org/
>
>BUG: KCSAN: data-race in do_epoll_ctl / do_epoll_wait

I think this needs to be part of the same list-fix-a-data-race-around-ep-rdllist.patch

Thanks,
Davidlohr