Received-SPF: pass (google.com: domain of linux-kernel+bounces-168570-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
From: Hillf Danton <hdanton@sina.com>
To: Al Viro <viro@zeniv.linux.org.uk>
Cc: linux-kernel@vger.kernel.org,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Kees Cook <keescook@chromium.org>,
	Christian Konig <christian.koenig@amd.com>,
	minhquangbui99@gmail.com,
	syzbot+045b454ab35fd82a35fb@syzkaller.appspotmail.com,
	syzkaller-bugs@googlegroups.com
Subject: Re: [PATCH] epoll: try to be a _bit_ better about file lifetimes
Date: Sat,  4 May 2024 17:25:55 +0800
Message-Id: <20240504092555.2071-1-hdanton@sina.com>
In-Reply-To: <20240503212428.GY2118490@ZenIV>
References: <202405031110.6F47982593@keescook> <20240503211129.679762-2-torvalds@linux-foundation.org>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

On Fri, 3 May 2024 22:24:28 +0100 Al Viro wrote:
> On Fri, May 03, 2024 at 02:11:30PM -0700, Linus Torvalds wrote:
> > epoll is a mess, and does various invalid things in the name of
> > performance.
> > 
> > Let's try to rein it in a bit. Something like this, perhaps?
> 
> > +/*
> > + * The ffd.file pointer may be in the process of
> > + * being torn down due to being closed, but we
> > + * may not have finished eventpoll_release() yet.
> > + *
> > + * Technically, even with the atomic_long_inc_not_zero,
> > + * the file may have been free'd and then gotten
> > + * re-allocated to something else (since files are
> > + * not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
> 
> Can we get to ep_item_poll(epi, ...) after eventpoll_release_file()
> got past __ep_remove()?  Because if we can, we have a worse problem -

Nope but mtx can help poll go before remove, see below.

> epi freed under us.
> 
> If not, we couldn't possibly have reached ->release() yet, let
> alone freeing anything.

Actually poll can see a file with zero f_count, and LT's idea with
trival change survived the syzbot repro [1].

I think fput currently can race with epoll wrt f_count, and checking
it in dma-buf is necessary if his idea looks too aggressive.

	wait_epoll()			__fput()
	do_epoll_wait()			eventpoll_release_file()
	ep_poll()
	ep_send_events()
	mutex_lock(&ep->mtx)
	ep_item_poll()
	vfs_poll()
	mutex_unlock(&ep->mtx)
					mutex_lock(&ep->mtx)
					dispose = __ep_remove(ep, epi, true)
					mutex_unlock(&ep->mtx)

[1] https://lore.kernel.org/lkml/000000000000f1c99d061798ac6d@google.com/