linux-kernel - Re: [PATCH] eventfd: avoid unnecessary wakeups in eventfd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230713-wellen-heftig-b950ad3e64d2@brauner>
Date:   Thu, 13 Jul 2023 10:56:19 +0200
From:   Christian Brauner <brauner@...nel.org>
To:     wenyang.linux@...mail.com
Cc:     Alexander Viro <viro@...iv.linux.org.uk>,
        Jens Axboe <axboe@...nel.dk>, Christoph Hellwig <hch@....de>,
        Dylan Yudaken <dylany@...com>,
        David Woodhouse <dwmw@...zon.co.uk>,
        Matthew Wilcox <willy@...radead.org>,
        linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] eventfd: avoid unnecessary wakeups in eventfd_write()

On Thu, Jul 13, 2023 at 12:42:32AM +0800, wenyang.linux@...mail.com wrote:
> From: Wen Yang <wenyang.linux@...mail.com>
> 
> In eventfd_write(), when ucnt is 0 and ctx->count is also 0,
> current->in_eventfd will be set to 1, which may affect eventfd_signal(),
> and unnecessary wakeups will also be performed.
> 
> Fix this issue by ensuring that ctx->count is not zero.
> 
> Signed-off-by: Wen Yang <wenyang.linux@...mail.com>
> Cc: Alexander Viro <viro@...iv.linux.org.uk>
> Cc: Jens Axboe <axboe@...nel.dk>
> Cc: Christian Brauner <brauner@...nel.org>
> Cc: Christoph Hellwig <hch@....de>
> Cc: Dylan Yudaken <dylany@...com>
> Cc: David Woodhouse <dwmw@...zon.co.uk>
> Cc: Matthew Wilcox <willy@...radead.org>
> Cc: linux-fsdevel@...r.kernel.org
> Cc: linux-kernel@...r.kernel.org
> ---
>  fs/eventfd.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
> 
> diff --git a/fs/eventfd.c b/fs/eventfd.c
> index 33a918f9566c..254b18ff0e00 100644
> --- a/fs/eventfd.c
> +++ b/fs/eventfd.c
> @@ -281,10 +281,12 @@ static ssize_t eventfd_write(struct file *file, const char __user *buf, size_t c
>  	}
>  	if (likely(res > 0)) {
>  		ctx->count += ucnt;
> -		current->in_eventfd = 1;
> -		if (waitqueue_active(&ctx->wqh))
> -			wake_up_locked_poll(&ctx->wqh, EPOLLIN);
> -		current->in_eventfd = 0;
> +		if (ctx->count) {
> +			current->in_eventfd = 1;
> +			if (waitqueue_active(&ctx->wqh))
> +				wake_up_locked_poll(&ctx->wqh, EPOLLIN);
> +			current->in_eventfd = 0;
> +		}
>  	}
>  	spin_unlock_irq(&ctx->wqh.lock);

I don't think we can do this. Consider the following:

        struct pollfd pfd = {
                .events = POLLIN | POLLOUT,
        };

        int fd = eventfd(0, 0);
        if (fd < 0)
                return -1;

        write(fd, &w, sizeof(__u64));

        poll(&pfd, 1, -1);

        printf("%d\n", pfd.revents & POLLOUT);

Currently, the eventfd_poll() will do:

        ULLONG_MAX - 1 > ctx->count

informing pollers with POLLOUT that the eventfd is writable, iow, that
the count has overflowed.

After your change such POLLOUT waiters will hang forever even though the
eventfd is writable.

So currently, a zero write on an eventfd can be used to inform another
process that they can write. This breaks this completely.

Caller's that don't want to be woken up on zero writes should just not
set POLLOUT:

        struct pollfd pfd = {
                .events = POLLIN,
        };

        int fd = eventfd(0, 0);
        if (fd < 0)
                return -1;

        write(fd, &w, sizeof(__u64));

        poll(&pfd, 1, -1);

This will wait until someone actually writes something.