On Mon, Aug 31, 2020 at 12:48:13PM -0700, syzbot wrote: > Hello, > > syzbot found the following issue on: > > HEAD commit: 15bc20c6 Merge tag 'tty-5.9-rc3' of git://git.kernel.org/p.. > git tree: upstream > console output: https://syzkaller.appspot.com/x/log.txt?x=16a85669900000 > kernel config: https://syzkaller.appspot.com/x/.config?x=891ca5711a9f1650 > dashboard link: https://syzkaller.appspot.com/bug?extid=e24baf53dc389927a7c3 > compiler: clang version 10.0.0 (https://github.com/llvm/llvm-project/ c2443155a0fb245c8f17f2c1c72b6ea391e86e81) > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=127d3c99900000 > The issue was bisected to: > > commit a9ed4a6560b8562b7e2e2bed9527e88001f7b682 > Author: Marc Zyngier <maz@xxxxxxxxxx> > Date: Wed Aug 19 16:12:17 2020 +0000 > > epoll: Keep a reference on files added to the check list All of those are essentially duplicates. The minimal fix is below; I'm not happy with it long-term, but I'm still digging through the eventpoll locking, and there's a good chance that this is the least intrusive variant for -stable. Folks, could you check if the following patch fixes those suckers? Again, all reports bisected to that commit are essentially the same. diff --git a/fs/eventpoll.c b/fs/eventpoll.c index e0decff22ae2..8107e06d7f6f 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1995,9 +1995,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) * during ep_insert(). */ if (list_empty(&epi->ffd.file->f_tfile_llink)) { - get_file(epi->ffd.file); - list_add(&epi->ffd.file->f_tfile_llink, - &tfile_check_list); + if (get_file_rcu(epi->ffd.file)) + list_add(&epi->ffd.file->f_tfile_llink, + &tfile_check_list); } } }
