linux-kernel - [PATCH vfs.fixes] eventpoll: Prevent hang in epoll

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250429153419.94723-1-jdamato@fastly.com>
Date: Tue, 29 Apr 2025 15:34:19 +0000
From: Joe Damato <jdamato@...tly.com>
To: linux-fsdevel@...r.kernel.org
Cc: Joe Damato <jdamato@...tly.com>,
	Christian Brauner <brauner@...nel.org>,
	Mike Pagano <mpagano@...too.org>,
	Carlos Llamas <cmllamas@...gle.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Jan Kara <jack@...e.cz>,
	linux-kernel@...r.kernel.org (open list)
Subject: [PATCH vfs.fixes] eventpoll: Prevent hang in epoll_wait

In commit 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the
future"), a bug was introduced causing the loop in ep_poll to hang under
certain circumstances.

When the timeout is non-NULL and ep_schedule_timeout returns false, the
flag timed_out was not set to true. This causes a hang.

Adjust the logic and set timed_out, if needed, fixing the original code.

Reported-by: Christian Brauner <brauner@...nel.org>
Closes: https://lore.kernel.org/linux-fsdevel/20250426-haben-redeverbot-0b58878ac722@brauner/
Reported-by: Mike Pagano <mpagano@...too.org>
Closes: https://bugs.gentoo.org/954806
Reported-by: Carlos Llamas <cmllamas@...gle.com>
Closes: https://lore.kernel.org/linux-fsdevel/aBAB_4gQ6O_haAjp@google.com/
Fixes: 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the future")
Tested-by: Carlos Llamas <cmllamas@...gle.com>
Signed-off-by: Joe Damato <jdamato@...tly.com>
---
 fs/eventpoll.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 4bc264b854c4..1a5d1147f082 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -2111,7 +2111,9 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events,
 
 		write_unlock_irq(&ep->lock);
 
-		if (!eavail && ep_schedule_timeout(to))
+		if (!ep_schedule_timeout(to))
+			timed_out = 1;
+		else if (!eavail)
 			timed_out = !schedule_hrtimeout_range(to, slack,
 							      HRTIMER_MODE_ABS);
 		__set_current_state(TASK_RUNNING);

base-commit: f520bed25d17bb31c2d2d72b0a785b593a4e3179
-- 
2.43.0