This is a note to let you know that I've just added the patch titled signalfd: use wake_up_pollfree() to the 4.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: signalfd-use-wake_up_pollfree.patch and it can be found in the queue-4.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sun Dec 12 02:49:35 PM CET 2021 From: Eric Biggers <ebiggers@xxxxxxxxxx> Date: Fri, 10 Dec 2021 16:28:32 -0800 Subject: signalfd: use wake_up_pollfree() To: stable@xxxxxxxxxxxxxxx Cc: linux-kernel@xxxxxxxxxxxxxxx, Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Message-ID: <20211211002832.153742-4-ebiggers@xxxxxxxxxx> From: Eric Biggers <ebiggers@xxxxxxxxxx> commit 9537bae0da1f8d1e2361ab6d0479e8af7824e160 upstream. wake_up_poll() uses nr_exclusive=1, so it's not guaranteed to wake up all exclusive waiters. Yet, POLLFREE *must* wake up all waiters. epoll and aio poll are fortunately not affected by this, but it's very fragile. Thus, the new function wake_up_pollfree() has been introduced. Convert signalfd to use wake_up_pollfree(). Reported-by: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Fixes: d80e731ecab4 ("epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()") Cc: stable@xxxxxxxxxxxxxxx Link: https://lore.kernel.org/r/20211209010455.42744-4-ebiggers@xxxxxxxxxx Signed-off-by: Eric Biggers <ebiggers@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/signalfd.c | 12 +----------- 1 file changed, 1 insertion(+), 11 deletions(-) --- a/fs/signalfd.c +++ b/fs/signalfd.c @@ -34,17 +34,7 @@ void signalfd_cleanup(struct sighand_struct *sighand) { - wait_queue_head_t *wqh = &sighand->signalfd_wqh; - /* - * The lockless check can race with remove_wait_queue() in progress, - * but in this case its caller should run under rcu_read_lock() and - * sighand_cachep is SLAB_DESTROY_BY_RCU, we can safely return. - */ - if (likely(!waitqueue_active(wqh))) - return; - - /* wait_queue_t->func(POLLFREE) should do remove_wait_queue() */ - wake_up_poll(wqh, POLLHUP | POLLFREE); + wake_up_pollfree(&sighand->signalfd_wqh); } struct signalfd_ctx { Patches currently in stable-queue which might be from ebiggers@xxxxxxxxxx are queue-4.4/binder-use-wake_up_pollfree.patch queue-4.4/wait-add-wake_up_pollfree.patch queue-4.4/signalfd-use-wake_up_pollfree.patch