From patchwork Thu Nov 24 00:11:22 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rishabh Bhatnagar X-Patchwork-Id: 25250 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp3106167wrr; Wed, 23 Nov 2022 16:19:09 -0800 (PST) X-Google-Smtp-Source: AA0mqf5NTMaNn2rtoNsAaDS/6UtjmZyTlNHKRso5Fp4qY8h59yhOn3eJ0SEYkg7n30hiiIRoayH+ X-Received: by 2002:a63:7143:0:b0:46f:918e:7338 with SMTP id b3-20020a637143000000b0046f918e7338mr11138676pgn.8.1669249149394; Wed, 23 Nov 2022 16:19:09 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669249149; cv=none; d=google.com; s=arc-20160816; b=oN6lI9ilkes8VuYb2aW6keB120R588NfKfkpqlABuSeloAt+3Tq73g4YuFu3x5vxrr gW8a4EgSewTrcT9ywPRlJn76SPfJZ62jBd50UCADudDxMls/thP+Ke279QdFBVNzSsRZ BjjITgn+URZpmtxxRbWiVUTx9QPo7WD9Mx4t26esUuma5gxHSFn6BHyGVDoYWqDQOw1p jiXNjaMNEpJcTzaJiM1dheTIm1akvtJ6ZWrRbEqc5igLRAiwl8L6PdW/NUREmTRbNon3 4fob2x19O7umMB8JfI04yMcMq0HkZ/jfIHfMqoWCp8/E62CTMjRFw54Fp7RhIk7zMMs3 NVlA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=HsaYmEBZ2D4kRCGcsqMdWbhVBRYbJtEAV6N40hYOmOo=; b=lajCl++ZNIKM96Bvq8ae+L7AtUwlJ7pQVWek9SfRX8shbNZHezCCponlWDINoZOOpb +kpAEmYcDEy6PO21BoYxEC5yC1RykFjwiHrw2u66Y8j7kvpJtSTR/NFcJTQ/g3yOp5aW aTMOUwQVPAjoY9Mp/aXNF2DAS9WwGsOuMRcnNwfM8TM6GfhRlEJfgOMOJLhKg5RIksrk oW4oWf0TnCkfJR9oc25TD/FoP+8/qEFo6ZzJLcb69dAID8bwK5QX3TlX2Ii5UhQ1rDZT 3eHWa5UKAJ9V67TsrUsm8wvvw5NeAxbbrh9+OyOT5L4rA2ZXcvtg8c10oq72aA2wvmxF rF1A== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amazon.com header.s=amazon201209 header.b=FuNJnXFT; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id s22-20020a170902989600b00188e877e8ddsi16792962plp.139.2022.11.23.16.18.56; Wed, 23 Nov 2022 16:19:09 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@amazon.com header.s=amazon201209 header.b=FuNJnXFT; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229607AbiKXALq (ORCPT + 99 others); Wed, 23 Nov 2022 19:11:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229500AbiKXALn (ORCPT ); Wed, 23 Nov 2022 19:11:43 -0500 Received: from smtp-fw-80007.amazon.com (smtp-fw-80007.amazon.com [99.78.197.218]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E7668657C8; Wed, 23 Nov 2022 16:11:42 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1669248702; x=1700784702; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=HsaYmEBZ2D4kRCGcsqMdWbhVBRYbJtEAV6N40hYOmOo=; b=FuNJnXFTvftzTUMyjI9DtamtXRzbPRclRmG5dMShElCUepIxt6xqZqmU CdU5sjsghgu7Dn7M/vcA8xyHAKXxGY5yQE6T2EAE/ZYvth4mJWtuXwred 4z7pfvVzMn8plFFO6MpSdF/Nx78RsL0dMVhdVJe1Ry1zuYglc7TMxlk9f A=; X-IronPort-AV: E=Sophos;i="5.96,187,1665446400"; d="scan'208";a="154218830" Received: from pdx4-co-svc-p1-lb2-vlan3.amazon.com (HELO email-inbound-relay-iad-1d-m6i4x-153b24bc.us-east-1.amazon.com) ([10.25.36.214]) by smtp-border-fw-80007.pdx80.corp.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Nov 2022 00:11:40 +0000 Received: from EX13MTAUWC002.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1d-m6i4x-153b24bc.us-east-1.amazon.com (Postfix) with ESMTPS id D3AD8C1F69; Thu, 24 Nov 2022 00:11:36 +0000 (UTC) Received: from EX19D002UWC003.ant.amazon.com (10.13.138.183) by EX13MTAUWC002.ant.amazon.com (10.43.162.240) with Microsoft SMTP Server (TLS) id 15.0.1497.42; Thu, 24 Nov 2022 00:11:35 +0000 Received: from EX13MTAUWA001.ant.amazon.com (10.43.160.58) by EX19D002UWC003.ant.amazon.com (10.13.138.183) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.20; Thu, 24 Nov 2022 00:11:35 +0000 Received: from dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (10.189.73.169) by mail-relay.amazon.com (10.43.160.118) with Microsoft SMTP Server id 15.0.1497.42 via Frontend Transport; Thu, 24 Nov 2022 00:11:35 +0000 Received: by dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (Postfix, from userid 22673075) id B0195ABFD; Thu, 24 Nov 2022 00:11:35 +0000 (UTC) From: Rishabh Bhatnagar To: , , , CC: , , , Roman Penyaev , Jason Baron , Randy Dunlap , Andrew Morton , Khazhismel Kumykov , "Linus Torvalds" , Rishabh Bhatnagar Subject: [PATCH 5.4 1/2] epoll: call final ep_events_available() check under the lock Date: Thu, 24 Nov 2022 00:11:22 +0000 Message-ID: <20221124001123.3248571-2-risbhat@amazon.com> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20221124001123.3248571-1-risbhat@amazon.com> References: <20221124001123.3248571-1-risbhat@amazon.com> MIME-Version: 1.0 X-Spam-Status: No, score=-11.9 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750334595656136679?= X-GMAIL-MSGID: =?utf-8?q?1750334595656136679?= From: Roman Penyaev Commit 65759097d804d2a9ad2b687db436319704ba7019 upstream. There is a possible race when ep_scan_ready_list() leaves ->rdllist and ->obflist empty for a short period of time although some events are pending. It is quite likely that ep_events_available() observes empty lists and goes to sleep. Since commit 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll") we are conservative in wakeups (there is only one place for wakeup and this is ep_poll_callback()), thus ep_events_available() must always observe correct state of two lists. The easiest and correct way is to do the final check under the lock. This does not impact the performance, since lock is taken anyway for adding a wait entry to the wait queue. The discussion of the problem can be found here: https://lore.kernel.org/linux-fsdevel/a2f22c3c-c25a-4bda-8339-a7bdaf17849e@akamai.com/ In this patch barrierless __set_current_state() is used. This is safe since waitqueue_active() is called under the same lock on wakeup side. Short-circuit for fatal signals (i.e. fatal_signal_pending() check) is moved to the line just before actual events harvesting routine. This is fully compliant to what is said in the comment of the patch where the actual fatal_signal_pending() check was added: c257a340ede0 ("fs, epoll: short circuit fetching events if thread has been killed"). Fixes: 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll") Reported-by: Jason Baron Reported-by: Randy Dunlap Signed-off-by: Roman Penyaev Signed-off-by: Andrew Morton Reviewed-by: Jason Baron Cc: Khazhismel Kumykov Cc: Alexander Viro Cc: Link: http://lkml.kernel.org/r/20200505145609.1865152-1-rpenyaev@suse.de Signed-off-by: Linus Torvalds Signed-off-by: Rishabh Bhatnagar Acked-by: Thadeu Lima de Souza Cascardo --- fs/eventpoll.c | 47 +++++++++++++++++++++++++++-------------------- 1 file changed, 27 insertions(+), 20 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 7e11135bc915..e5496483a882 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1905,33 +1905,31 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, init_wait(&wait); wait.func = ep_autoremove_wake_function; write_lock_irq(&ep->lock); - __add_wait_queue_exclusive(&ep->wq, &wait); - write_unlock_irq(&ep->lock); - /* - * We don't want to sleep if the ep_poll_callback() sends us - * a wakeup in between. That's why we set the task state - * to TASK_INTERRUPTIBLE before doing the checks. + * Barrierless variant, waitqueue_active() is called under + * the same lock on wakeup ep_poll_callback() side, so it + * is safe to avoid an explicit barrier. */ - set_current_state(TASK_INTERRUPTIBLE); + __set_current_state(TASK_INTERRUPTIBLE); + /* - * Always short-circuit for fatal signals to allow - * threads to make a timely exit without the chance of - * finding more events available and fetching - * repeatedly. + * Do the final check under the lock. ep_scan_ready_list() + * plays with two lists (->rdllist and ->ovflist) and there + * is always a race when both lists are empty for short + * period of time although events are pending, so lock is + * important. */ - if (fatal_signal_pending(current)) { - res = -EINTR; - break; + eavail = ep_events_available(ep); + if (!eavail) { + if (signal_pending(current)) + res = -EINTR; + else + __add_wait_queue_exclusive(&ep->wq, &wait); } + write_unlock_irq(&ep->lock); - eavail = ep_events_available(ep); - if (eavail) - break; - if (signal_pending(current)) { - res = -EINTR; + if (eavail || res) break; - } if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) { timed_out = 1; @@ -1952,6 +1950,15 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, } send_events: + if (fatal_signal_pending(current)) { + /* + * Always short-circuit for fatal signals to allow + * threads to make a timely exit without the chance of + * finding more events available and fetching + * repeatedly. + */ + res = -EINTR; + } /* * Try to transfer events to user space. In case we get 0 events and * there's still timeout left over, we go trying again in search of From patchwork Thu Nov 24 00:11:23 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rishabh Bhatnagar X-Patchwork-Id: 25253 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp3106940wrr; Wed, 23 Nov 2022 16:21:03 -0800 (PST) X-Google-Smtp-Source: AA0mqf7kr+LzGwSomDV+2u5+QTaZjDanG16tH+aYvn2D7ujpYlX4mP79bQUQDJGhia40skrMb9UD X-Received: by 2002:a17:90a:5c85:b0:20a:92d2:226a with SMTP id r5-20020a17090a5c8500b0020a92d2226amr21681311pji.155.1669249262881; Wed, 23 Nov 2022 16:21:02 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669249262; cv=none; d=google.com; s=arc-20160816; b=I6fKPS7hBLug5e2fsaMrFuGfFcwcknFsSrgee7rgvulmlsPZSMa21771mKqPjas9S1 2JYdTSN2ZMOkCnP75NLt1daoJK6azk7Il4+QYpYesXqU36YugtI3ioQev1hTXsXRmX+q GNmyaJZJ7UZUq0SEOXmMfJ/FHduR0KLW1CRPH6PCb85iqLc1szqKyv98vjKJ/LJoA1Db PgIMBk5KtHGbR21khepCgGVxplq4Y+KBNRsv64LGgUp5d8V0MOfSexfUoFPJBBuCVdWu KIZ6IiOz1ulrlg5tW2y19d2wKmSQk8ufniDxne0BqmuoxzRGzBnsuL23+I4Nw6B5giRH HZeA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=FtoEGFIFtNtH2rZixELgHast4muQhN87FUrXFKCArio=; b=l58MUVZ5DIvmQXhjdiafSx840y4/mLBhSsR0GOUL1xZM3kXCghewgRudLcrt9v4CaZ wwwJcHC+Ezu7E7Y9h3mnO8wiTU544TNYZIXl9+4ot6k2vqf8E04b25uSel49k97ZvsLX yQT+SQwsHdNehIQqBIFuPgmZ8lQJU+dbKJBAbaS4Dabrf3VbGzg4Bl5XCNP/7ZdgeLKW 7daQHBaT5w9fLc1Gk/z5qx2WtstocyvUDSRgG24/bZC6FfQWIdY5tlIBxRA/y4xTB4HA QidJSTnxRDtIiSaAbmZBmzk9P0aOAKcU/YZJNgyGmbCIFHPEFaUG7NasmGMHqXq0n3PO MLbg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@amazon.com header.s=amazon201209 header.b=FWiB4Cg8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id q9-20020a170902f34900b00186fd58858bsi15451786ple.158.2022.11.23.16.20.50; Wed, 23 Nov 2022 16:21:02 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@amazon.com header.s=amazon201209 header.b=FWiB4Cg8; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=amazon.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229547AbiKXAMO (ORCPT + 99 others); Wed, 23 Nov 2022 19:12:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41354 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229455AbiKXAMN (ORCPT ); Wed, 23 Nov 2022 19:12:13 -0500 Received: from smtp-fw-80006.amazon.com (smtp-fw-80006.amazon.com [99.78.197.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4D02A391E0; Wed, 23 Nov 2022 16:12:12 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1669248732; x=1700784732; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=FtoEGFIFtNtH2rZixELgHast4muQhN87FUrXFKCArio=; b=FWiB4Cg8z2psDns0HF0HLPauSOtBUxoZYvphWJghi5vjDuHpsAuPzV8k VI1U5XtD1tzOwggeaFgrGE0YbI6z93rKeCQTLG/Li4BfENAz4Sipr6OgE uCVKGTESr1/ANC2GiN4N/M5ycxalLjqZD6+S8/qHViQjmy3xMkOlfFBMz c=; X-IronPort-AV: E=Sophos;i="5.96,187,1665446400"; d="scan'208";a="154207588" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO email-inbound-relay-iad-1e-m6i4x-529f0975.us-east-1.amazon.com) ([10.25.36.210]) by smtp-border-fw-80006.pdx80.corp.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 24 Nov 2022 00:12:10 +0000 Received: from EX13MTAUWC002.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1e-m6i4x-529f0975.us-east-1.amazon.com (Postfix) with ESMTPS id ADEA0423D3; Thu, 24 Nov 2022 00:12:05 +0000 (UTC) Received: from EX19D002UWA003.ant.amazon.com (10.13.138.235) by EX13MTAUWC002.ant.amazon.com (10.43.162.240) with Microsoft SMTP Server (TLS) id 15.0.1497.42; Thu, 24 Nov 2022 00:11:38 +0000 Received: from EX13MTAUEE002.ant.amazon.com (10.43.62.24) by EX19D002UWA003.ant.amazon.com (10.13.138.235) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.20; Thu, 24 Nov 2022 00:11:37 +0000 Received: from dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (10.189.73.169) by mail-relay.amazon.com (10.43.62.224) with Microsoft SMTP Server id 15.0.1497.42 via Frontend Transport; Thu, 24 Nov 2022 00:11:36 +0000 Received: by dev-dsk-risbhat-2b-8bdc64cd.us-west-2.amazon.com (Postfix, from userid 22673075) id C1383ABFD; Thu, 24 Nov 2022 00:11:36 +0000 (UTC) From: Rishabh Bhatnagar To: , , , CC: , , , Soheil Hassas Yeganeh , "Guantao Liu" , Linus Torvalds , Eric Dumazet , Willem de Bruijn , Khazhismel Kumykov , Davidlohr Bueso , Andrew Morton , Rishabh Bhatnagar Subject: [PATCH 2/2] epoll: check for events when removing a timed out thread from the wait queue Date: Thu, 24 Nov 2022 00:11:23 +0000 Message-ID: <20221124001123.3248571-3-risbhat@amazon.com> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20221124001123.3248571-1-risbhat@amazon.com> References: <20221124001123.3248571-1-risbhat@amazon.com> MIME-Version: 1.0 X-Spam-Status: No, score=-11.9 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_MED, RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS,USER_IN_DEF_SPF_WL autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750334714811390743?= X-GMAIL-MSGID: =?utf-8?q?1750334714811390743?= From: Soheil Hassas Yeganeh Commit 289caf5d8f6c61c6d2b7fd752a7f483cd153f182 upstream. Patch series "simplify ep_poll". This patch series is a followup based on the suggestions and feedback by Linus: https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com The first patch in the series is a fix for the epoll race in presence of timeouts, so that it can be cleanly backported to all affected stable kernels. The rest of the patch series simplify the ep_poll() implementation. Some of these simplifications result in minor performance enhancements as well. We have kept these changes under self tests and internal benchmarks for a few days, and there are minor (1-2%) performance enhancements as a result. This patch (of 8): After abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2) timeout"), we break out of the ep_poll loop upon timeout, without checking whether there is any new events available. Prior to that patch-series we always called ep_events_available() after exiting the loop. This can cause races and missed wakeups. For example, consider the following scenario reported by Guantao Liu: Suppose we have an eventfd added using EPOLLET to an epollfd. Thread 1: Sleeps for just below 5ms and then writes to an eventfd. Thread 2: Calls epoll_wait with a timeout of 5 ms. If it sees an event of the eventfd, it will write back on that fd. Thread 3: Calls epoll_wait with a negative timeout. Prior to abc610e01c66, it is guaranteed that Thread 3 will wake up either by Thread 1 or Thread 2. After abc610e01c66, Thread 3 can be blocked indefinitely if Thread 2 sees a timeout right before the write to the eventfd by Thread 1. Thread 2 will be woken up from schedule_hrtimeout_range and, with evail 0, it will not call ep_send_events(). To fix this issue: 1) Simplify the timed_out case as suggested by Linus. 2) while holding the lock, recheck whether the thread was woken up after its time out has reached. Note that (2) is different from Linus' original suggestion: It do not set "eavail = ep_events_available(ep)" to avoid unnecessary contention (when there are too many timed-out threads and a small number of events), as well as races mentioned in the discussion thread. This is the first patch in the series so that the backport to stable releases is straightforward. Link: https://lkml.kernel.org/r/20201106231635.3528496-1-soheil.kdev@gmail.com Link: https://lkml.kernel.org/r/CAHk-=wizk=OxUyQPbO8MS41w2Pag1kniUV5WdD5qWL-gq1kjDA@mail.gmail.com Link: https://lkml.kernel.org/r/20201106231635.3528496-2-soheil.kdev@gmail.com Fixes: abc610e01c66 ("fs/epoll: avoid barrier after an epoll_wait(2) timeout") Signed-off-by: Soheil Hassas Yeganeh Tested-by: Guantao Liu Suggested-by: Linus Torvalds Reported-by: Guantao Liu Reviewed-by: Eric Dumazet Reviewed-by: Willem de Bruijn Reviewed-by: Khazhismel Kumykov Reviewed-by: Davidlohr Bueso Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Rishabh Bhatnagar Acked-by: Thadeu Lima de Souza Cascardo --- fs/eventpoll.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index e5496483a882..877f9f61a4e8 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1928,23 +1928,30 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, } write_unlock_irq(&ep->lock); - if (eavail || res) - break; + if (!eavail && !res) + timed_out = !schedule_hrtimeout_range(to, slack, + HRTIMER_MODE_ABS); - if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) { - timed_out = 1; - break; - } - - /* We were woken up, thus go and try to harvest some events */ + /* + * We were woken up, thus go and try to harvest some events. + * If timed out and still on the wait queue, recheck eavail + * carefully under lock, below. + */ eavail = 1; - } while (0); __set_current_state(TASK_RUNNING); if (!list_empty_careful(&wait.entry)) { write_lock_irq(&ep->lock); + /* + * If the thread timed out and is not on the wait queue, it + * means that the thread was woken up after its timeout expired + * before it could reacquire the lock. Thus, when wait.entry is + * empty, it needs to harvest events. + */ + if (timed_out) + eavail = list_empty(&wait.entry); __remove_wait_queue(&ep->wq, &wait); write_unlock_irq(&ep->lock); }