[Linaro-mm-sig] Re: [PATCH] epoll: try to be a _bit_ better about file lifetimes

On Fri, May 03, 2024 at 02:33:37PM -0700, Linus Torvalds wrote:

Look at the hack in __ep_remove(): if it is concurrent with eventpoll_release_file(), it will hit this code

    spin_lock(&file->f_lock);
    if (epi->dying && !force) {
            spin_unlock(&file->f_lock);
            return false;
    }

and not free the epi.

What does that have to do with ep_item_poll()?

eventpoll_release_file() itself calls __ep_remove(). Have that happen while ep_item_poll() is running in another thread and you've got a problem.

AFAICS, exclusion is on ep->mtx. Callers of ep_item_poll() are * __ep_eventpoll_poll() - grabs ->mtx * ep_insert() - called under ->mtx * ep_modify() - calls are under ->mtx * ep_send_events() - grabs ->mtx

and eventpoll_release_file() grabs ->mtx around __ep_remove().

How do you get through eventpoll_release_file() while someone has entered ep_item_poll()?