6.11-stable review patch. If anyone has any objections, please let me know. ------------------ From: Martin Karsten <mkarsten@xxxxxxxxxxxx> commit b9ca079dd6b09e08863aa998edf5c47597806c05 upstream. A struct eventpoll's busy_poll_usecs field can be modified via a user ioctl at any time. All reads of this field should be annotated with READ_ONCE. Fixes: 85455c795c07 ("eventpoll: support busy poll per epoll instance") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Martin Karsten <mkarsten@xxxxxxxxxxxx> Link: https://lore.kernel.org/r/20240806123301.167557-1-jdamato@xxxxxxxxxx Reviewed-by: Joe Damato <jdamato@xxxxxxxxxx> Signed-off-by: Christian Brauner <brauner@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/eventpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -420,7 +420,7 @@ static bool busy_loop_ep_timeout(unsigne static bool ep_busy_loop_on(struct eventpoll *ep) { - return !!ep->busy_poll_usecs || net_busy_loop_on(); + return !!READ_ONCE(ep->busy_poll_usecs) || net_busy_loop_on(); } static bool ep_busy_loop_end(void *p, unsigned long start_time)