On Fri, May 03, 2024 at 02:33:37PM -0700, Linus Torvalds wrote:
> Look at the hack in __ep_remove(): if it is concurrent with
> eventpoll_release_file(), it will hit this code
>
> spin_lock(&file->f_lock);
> if (epi->dying && !force) {
> spin_unlock(&file->f_lock);
> return false;
> }
>
> and not free the epi.
What does that have to do with ep_item_poll()?
eventpoll_release_file() itself calls __ep_remove(). Have that
happen while ep_item_poll() is running in another thread and
you've got a problem.
AFAICS, exclusion is on ep->mtx. Callers of ep_item_poll() are
* __ep_eventpoll_poll() - grabs ->mtx
* ep_insert() - called under ->mtx
* ep_modify() - calls are under ->mtx
* ep_send_events() - grabs ->mtx
and eventpoll_release_file() grabs ->mtx around __ep_remove().
How do you get through eventpoll_release_file() while someone
has entered ep_item_poll()?
