linux-kernel - Re: [PATCH v3] eventpoll: Fix priority inversion problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250626154954.NH9L0mtz@linutronix.de>
Date: Thu, 26 Jun 2025 17:49:54 +0200
From: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To: John Ogness <john.ogness@...utronix.de>
Cc: Nam Cao <namcao@...utronix.de>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	Clark Williams <clrkwllms@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-rt-devel@...ts.linux.dev,
	linux-rt-users@...r.kernel.org, Joe Damato <jdamato@...tly.com>,
	Martin Karsten <mkarsten@...terloo.ca>,
	Jens Axboe <axboe@...nel.dk>,
	Frederic Weisbecker <frederic@...nel.org>,
	Valentin Schneider <vschneid@...hat.com>
Subject: Re: [PATCH v3] eventpoll: Fix priority inversion problem

On 2025-06-26 17:29:46 [+0206], John Ogness wrote:
> > @@ -361,10 +348,14 @@ static inline int ep_cmp_ffd(struct epoll_filefd *p1,
> >  	        (p1->file < p2->file ? -1 : p1->fd - p2->fd));
> >  }
> >  
> > -/* Tells us if the item is currently linked */
> > -static inline int ep_is_linked(struct epitem *epi)
> > +/*
> > + * Add the item to its container eventpoll's rdllist; do nothing if the item is already on rdllist.
> > + */
> > +static void epitem_ready(struct epitem *epi)
> >  {
> > -	return !list_empty(&epi->rdllink);
> > +	if (&epi->rdllink == cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL))
> 
> Perhaps:
> 
> 	if (try_cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL))

Not sure this is the same.
This will write back the current value of epi->rdllink.next to
epi->rdllink if epi->rdllink.next is not &epi->rdllink.

The intention is to check if epi->rdllink.next is set to &epi->rdllink
(pointing to itself) and if so set it NULL just to avoid to ensure
further cmpxchg() will fail here.

> > +		llist_add(&epi->rdllink, &epi->ep->rdllist);
> > +
> >  }
> >  
> >  static inline struct eppoll_entry *ep_pwq_from_wait(wait_queue_entry_t *p)
> 
> John Ogness

Sebastian