Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6717900f authored by Jan Kara's avatar Jan Kara Committed by Greg Kroah-Hartman
Browse files

select: Fix indefinitely sleeping task in poll_schedule_timeout() 



commit 68514dacf2715d11b91ca50d88de047c086fea9c upstream.

A task can end up indefinitely sleeping in do_select() ->
poll_schedule_timeout() when the following race happens:

  TASK1 (thread1)             TASK2                   TASK1 (thread2)
  do_select()
    setup poll_wqueues table
    with 'fd'
                              write data to 'fd'
                                pollwake()
                                  table->triggered = 1
                                                      closes 'fd' thread1 is
                                                        waiting for
    poll_schedule_timeout()
      - sees table->triggered
      table->triggered = 0
      return -EINTR
    loop back in do_select()

But at this point when TASK1 loops back, the fdget() in the setup of
poll_wqueues fails.  So now so we never find 'fd' is ready for reading
and sleep in poll_schedule_timeout() indefinitely.

Treat an fd that got closed as a fd on which some event happened.  This
makes sure cannot block indefinitely in do_select().

Another option would be to return -EBADF in this case but that has a
potential of subtly breaking applications that excercise this behavior
and it happens to work for them.  So returning fd as active seems like a
safer choice.

Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
CC: stable@vger.kernel.org
Signed-off-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent ac06e167

fs/select.c

+33 −30
Original line number Diff line number Diff line
@@ -431,9 +431,11 @@ static int max_select_fd(unsigned long n, fd_set_bits *fds) 
	return max;

}



#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR)

#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR)

#define POLLEX_SET (EPOLLPRI)

#define POLLIN_SET (EPOLLRDNORM | EPOLLRDBAND | EPOLLIN | EPOLLHUP | EPOLLERR |\

			EPOLLNVAL)

#define POLLOUT_SET (EPOLLWRBAND | EPOLLWRNORM | EPOLLOUT | EPOLLERR |\

			 EPOLLNVAL)

#define POLLEX_SET (EPOLLPRI | EPOLLNVAL)



static inline void wait_key_set(poll_table *wait, unsigned long in,

				unsigned long out, unsigned long bit,
@@ -500,6 +502,7 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time) 
					break;

				if (!(bit & all_bits))

					continue;

				mask = EPOLLNVAL;

				f = fdget(i);

				if (f.file) {

					wait_key_set(wait, in, out, bit,
@@ -507,6 +510,7 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time) 
					mask = vfs_poll(f.file, wait);



					fdput(f);

				}

				if ((mask & POLLIN_SET) && (in & bit)) {

					res_in |= bit;

					retval++;
@@ -535,7 +539,6 @@ static int do_select(int n, fd_set_bits *fds, struct timespec64 *end_time) 
					can_busy_loop = true;



			}

			}

			if (res_in)

				*rinp = res_in;

			if (res_out)