linux-kernel - Re: [PATCH v3] eventpoll: Fix priority inversion problem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250626155640.q8tGTFT-@linutronix.de>
Date: Thu, 26 Jun 2025 17:56:40 +0200
From: Nam Cao <namcao@...utronix.de>
To: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
Cc: John Ogness <john.ogness@...utronix.de>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Christian Brauner <brauner@...nel.org>, Jan Kara <jack@...e.cz>,
	Clark Williams <clrkwllms@...nel.org>,
	Steven Rostedt <rostedt@...dmis.org>, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org, linux-rt-devel@...ts.linux.dev,
	linux-rt-users@...r.kernel.org, Joe Damato <jdamato@...tly.com>,
	Martin Karsten <mkarsten@...terloo.ca>,
	Jens Axboe <axboe@...nel.dk>,
	Frederic Weisbecker <frederic@...nel.org>,
	Valentin Schneider <vschneid@...hat.com>
Subject: Re: [PATCH v3] eventpoll: Fix priority inversion problem

On Thu, Jun 26, 2025 at 05:49:54PM +0200, Sebastian Andrzej Siewior wrote:
> On 2025-06-26 17:29:46 [+0206], John Ogness wrote:
> > > @@ -361,10 +348,14 @@ static inline int ep_cmp_ffd(struct epoll_filefd *p1,
> > >  	        (p1->file < p2->file ? -1 : p1->fd - p2->fd));
> > >  }
> > >  
> > > -/* Tells us if the item is currently linked */
> > > -static inline int ep_is_linked(struct epitem *epi)
> > > +/*
> > > + * Add the item to its container eventpoll's rdllist; do nothing if the item is already on rdllist.
> > > + */
> > > +static void epitem_ready(struct epitem *epi)
> > >  {
> > > -	return !list_empty(&epi->rdllink);
> > > +	if (&epi->rdllink == cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL))
> > 
> > Perhaps:
> > 
> > 	if (try_cmpxchg(&epi->rdllink.next, &epi->rdllink, NULL))
> 
> Not sure this is the same.
> This will write back the current value of epi->rdllink.next to
> epi->rdllink if epi->rdllink.next is not &epi->rdllink.
> 
> The intention is to check if epi->rdllink.next is set to &epi->rdllink
> (pointing to itself) and if so set it NULL just to avoid to ensure
> further cmpxchg() will fail here.

Exactly, thanks Sebastian.

I tested the suggestion, and systemd blew up.

Nam