From nobody Mon Apr 13 10:19:59 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C8C0C19F2A for ; Thu, 4 Aug 2022 13:32:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239877AbiHDNcS (ORCPT ); Thu, 4 Aug 2022 09:32:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239815AbiHDNcE (ORCPT ); Thu, 4 Aug 2022 09:32:04 -0400 Received: from sender-of-o53.zoho.in (sender-of-o53.zoho.in [103.117.158.53]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32B223D597 for ; Thu, 4 Aug 2022 06:31:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1659619869; cv=none; d=zohomail.in; s=zohoarc; b=BuDznUG+XJjgZb6WOz1pkcQ7d1CiQCJ/Rl0Fxs92y5cQAUjXUHkSsOgA4qUBlagjlEwSaJgvM1XrfFP0/bPx+4gZLW7LH3k04lf2UsJ5ehlksME/y+esyGGVnvzL96eCjCZIhERXY6wx/zceqHkH5jmdgtMxCMpPjozI2BcVuDQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1659619869; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=y1Ovbial2FYc1BrqdnC91HLquYb0VtXHNQSWJNxyGjk=; b=Vt65eUbIR6LC/lPVxeJx2K/5XfUprgeWduCXOQzfPRMSLHVOwoXQqGtThc/ZBwZkUIao4x/pMRrWYV0fueCEmTt9pkxcDfhneYni5CPYO846NCXyGOGyv2jyGBOrEpN+cSkwSXGRVPBYy5QppY/QJy8ozquJzJyWj/orNv4eiqw= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1659619869; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Message-ID:Subject:Subject:Date:Date:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Content-Type:Message-Id:Reply-To; bh=y1Ovbial2FYc1BrqdnC91HLquYb0VtXHNQSWJNxyGjk=; b=BmE3ziSSl6JohUDLEyLx9hkQtNrVtt4pVMlwGVL5T7lxvJM9+qulfAiFSYYw0yzI 3fwxlkcUnIXTr/0ZKSxEOH6JZi3QBqN3ksPmBM9Liq7TadXR7ZpSQ7C+gLKYvTj5k/O QCewWX5y3RaccVFA598ES41lNj82qLKWXAv528ZQ= Received: from localhost.localdomain (103.250.137.206 [103.250.137.206]) by mx.zoho.in with SMTPS id 1659619867360682.4482276982302; Thu, 4 Aug 2022 19:01:07 +0530 (IST) From: Siddh Raman Pant To: Eric Biggers , Jonathan Corbet , David Howells , Randy Dunlap , Mauro Carvalho Chehab , Christophe JAILLET , Eric Dumazet Cc: linux-kernel , linux-kernel-mentees Message-ID: Subject: [PATCH 1/3 v4] kernel/watch_queue: Remove dangling pipe reference while clearing watch_queue Date: Thu, 4 Aug 2022 19:00:22 +0530 X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" If not done, a reference to a freed pipe remains in the watch_queue, as this function is called before freeing a pipe in free_pipe_info() (see line 834 of fs/pipe.c). We also need to use READ_ONCE() in post_one_notification() to prevent the compiler from optimising and loading a non-NULL value from wqueue->pipe. Signed-off-by: Siddh Raman Pant --- Changes in v4: - Brought the lines towards the start rather than the end. - Removed incorrect NULLing of wqueue->pipe->watch_queue. The latter was pointed out by Eric Biggers in reply to v3. Changes in v3: - Restored the original unlock order, and clear before unlock. - Used READ_ONCE() in post path. This was explained by David Howells in reply to v1. Changes in v2: - Removed the superfluous ifdef guard. kernel/watch_queue.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index a6f9bdd956c3..8999c4e3076d 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -99,7 +99,7 @@ static bool post_one_notification(struct watch_queue *wqu= eue, struct watch_notification *n) { void *p; - struct pipe_inode_info *pipe =3D wqueue->pipe; + struct pipe_inode_info *pipe =3D READ_ONCE(wqueue->pipe); struct pipe_buffer *buf; struct page *page; unsigned int head, tail, mask, note, offset, len; @@ -606,6 +606,9 @@ void watch_queue_clear(struct watch_queue *wqueue) /* Prevent new notifications from being stored. */ wqueue->defunct =3D true; =20 + /* This pipe will get freed by caller, and we are anyways clearing. */ + wqueue->pipe =3D NULL; + while (!hlist_empty(&wqueue->watches)) { watch =3D hlist_entry(wqueue->watches.first, struct watch, queue_node); hlist_del_init_rcu(&watch->queue_node); --=20 2.35.1 From nobody Mon Apr 13 10:19:59 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7700AC19F2A for ; Thu, 4 Aug 2022 13:32:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239857AbiHDNcK (ORCPT ); Thu, 4 Aug 2022 09:32:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230217AbiHDNcE (ORCPT ); Thu, 4 Aug 2022 09:32:04 -0400 Received: from sender-of-o53.zoho.in (sender-of-o53.zoho.in [103.117.158.53]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3D21E3D5AD for ; Thu, 4 Aug 2022 06:31:51 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1659619870; cv=none; d=zohomail.in; s=zohoarc; b=Q2ub6m9aXLeA4anYH/ssE1c1c5p5f0KYhUQW7SWGpRY5bRaCcWoLbELYckVz3zNmbVBPcRirxdPZ0IZTKi8jN+fqoGnWLkX5iVNcyw4CMN+IcNE9BTOEULiKoCbdLm0s7KzkYWMqHrvMH7pRCCn8yUWMwqddHTW0r7VFuZv4470= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1659619870; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=ML2EqkeHNsgj3TjKde7zyuOTBKOcYW9uCOulr/NrERw=; b=VumQp9GlQJAVdZoNgv7hWqG33TBtUGfyarYgiTklkHdvx1dadwucNhF1nTa4qfvyq5L2sULKeGOu+/aRIJJgIBxiw4RFMpbZjv5K4RtUZsycwW4hVdJneTBmcSzU2w+LVMK4ImE1TZ4CM0uIiQ3ZoCJOXP5UdSuHHmj+V/TgVVA= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1659619870; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Message-ID:Subject:Subject:Date:Date:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Content-Type:Message-Id:Reply-To; bh=ML2EqkeHNsgj3TjKde7zyuOTBKOcYW9uCOulr/NrERw=; b=iOPoGrRI9AkzB0ea2/BWWElK0YYqhqfQfx3CV83lDrqlCu2P3mxYZKzMJIfE1dxQ 7TU0bSgTnFnSkwt1g6XY/D8TuH72kyp9jzLPcPJh4eK8tMsrtto8AipTxfKWsiXCscD fv/P1TC/LHa/AVx6BxEogrKryFm8L8Aotdje8gsk= Received: from localhost.localdomain (103.250.137.206 [103.250.137.206]) by mx.zoho.in with SMTPS id 16596198680111014.2940277369726; Thu, 4 Aug 2022 19:01:08 +0530 (IST) From: Siddh Raman Pant To: Eric Biggers , Jonathan Corbet , David Howells , Randy Dunlap , Mauro Carvalho Chehab , Christophe JAILLET , Eric Dumazet Cc: linux-kernel , linux-kernel-mentees Message-ID: <6bac2d4c2b50d921eb16fa5344ffe258be90c651.1659618705.git.code@siddh.me> Subject: [PATCH 2/3] kernel/watch_queue: Improve struct annotation formatting Date: Thu, 4 Aug 2022 19:00:23 +0530 X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Improve formatting struct annotations in watch_queue.h, so that they fall in the preferred 80 character limit. Signed-off-by: Siddh Raman Pant --- include/linux/watch_queue.h | 96 +++++++++++++++++++++++++++---------- 1 file changed, 71 insertions(+), 25 deletions(-) diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h index fc6bba20273b..c99c39ec6548 100644 --- a/include/linux/watch_queue.h +++ b/include/linux/watch_queue.h @@ -18,57 +18,103 @@ =20 struct cred; =20 +/** + * watch_type_filter - Filter on watch type + * + * @type: Type of watch_notification + * @subtype_filter: Bitmask of subtypes to filter on + * @info_filter: Filter on watch_notification::info + * @info_mask: Mask of relevant bits in info_filter + */ struct watch_type_filter { enum watch_notification_type type; - __u32 subtype_filter[1]; /* Bitmask of subtypes to filter on */ - __u32 info_filter; /* Filter on watch_notification::info */ - __u32 info_mask; /* Mask of relevant bits in info_filter */ + __u32 subtype_filter[1]; + __u32 info_filter; + __u32 info_mask; }; =20 +/** + * watch_filter - Filter on watch + * + * @rcu: (union) RCU head + * @type_filter: (union) Bitmask of accepted types + * @nr_filters: Number of filters + * @filters: Array of watch_type_filter + */ struct watch_filter { union { struct rcu_head rcu; - /* Bitmask of accepted types */ DECLARE_BITMAP(type_filter, WATCH_TYPE__NR); }; - u32 nr_filters; /* Number of filters */ + u32 nr_filters; struct watch_type_filter filters[]; }; =20 +/** + * watch_queue - General notification queue + * + * @rcu: RCU head + * @filter: Filter on watch_notification::info + * @pipe: The pipe we're using as a buffer. + * @watches: Contributory watches + * @notes: Preallocated notifications + * @notes_bitmap: Allocation bitmap for notes + * @usage: Object usage count + * @lock: Spinlock + * @nr_notes: Number of notes + * @nr_pages: Number of pages in notes[] + * @defunct: True when queues closed + */ struct watch_queue { struct rcu_head rcu; struct watch_filter __rcu *filter; - struct pipe_inode_info *pipe; /* The pipe we're using as a buffer */ - struct hlist_head watches; /* Contributory watches */ - struct page **notes; /* Preallocated notifications */ - unsigned long *notes_bitmap; /* Allocation bitmap for notes */ - struct kref usage; /* Object usage count */ + struct pipe_inode_info *pipe; + struct hlist_head watches; + struct page **notes; + unsigned long *notes_bitmap; + struct kref usage; spinlock_t lock; - unsigned int nr_notes; /* Number of notes */ - unsigned int nr_pages; /* Number of pages in notes[] */ - bool defunct; /* T when queues closed */ + unsigned int nr_notes; + unsigned int nr_pages; + bool defunct; }; =20 -/* - * Representation of a watch on an object. +/** + * watch - Representation of a watch on an object. + * + * @rcu: (union) RCU head + * @info_id: (union) ID to be OR'd in to info field + * @queue: Queue to post events to + * @queue_node: Link in queue->watches + * @watch_list: Link in watch_list->watchers + * @list_node: The list node + * @cred: Creds of the owner of the watch + * @private: Private data for the watched object + * @id: Internal identifier + * @usage: Object usage count */ struct watch { union { struct rcu_head rcu; - u32 info_id; /* ID to be OR'd in to info field */ + u32 info_id; }; - struct watch_queue __rcu *queue; /* Queue to post events to */ - struct hlist_node queue_node; /* Link in queue->watches */ + struct watch_queue __rcu *queue; + struct hlist_node queue_node; struct watch_list __rcu *watch_list; - struct hlist_node list_node; /* Link in watch_list->watchers */ - const struct cred *cred; /* Creds of the owner of the watch */ - void *private; /* Private data for the watched object */ - u64 id; /* Internal identifier */ - struct kref usage; /* Object usage count */ + struct hlist_node list_node; + const struct cred *cred; + void *private; + u64 id; + struct kref usage; }; =20 -/* - * List of watches on an object. +/** + * watch_list - List of watches on an object. + * + * @rcu: RCU head + * @watchers: List head + * @release_watch: Function to release watch + * @lock: Spinlock */ struct watch_list { struct rcu_head rcu; --=20 2.35.1 From nobody Mon Apr 13 10:19:59 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EBC4DC19F2D for ; Thu, 4 Aug 2022 13:32:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239884AbiHDNcW (ORCPT ); Thu, 4 Aug 2022 09:32:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239834AbiHDNcE (ORCPT ); Thu, 4 Aug 2022 09:32:04 -0400 Received: from sender-of-o53.zoho.in (sender-of-o53.zoho.in [103.117.158.53]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14DE939BB4 for ; Thu, 4 Aug 2022 06:31:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1659619870; cv=none; d=zohomail.in; s=zohoarc; b=TArb8JuB1u/dt9SGveolRdb/0G0ugu3aYa+l3KDB45spz+YjqqkVpocnYSOYpQ/2FtLJYxOr/fJskGu4g6puJVbRd3y7vCxPoNi+MTX/H4rRrGDD0VY0S3yE68zhxfbf4hJXZquHpNI2GNDXaMegU05QmRBRPD5JSYRMZysnRvk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.in; s=zohoarc; t=1659619870; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:To; bh=e1Cbq8k6/3YzM7j1aQGJtFkkIjPn4LJXoM3g2nk5cLE=; b=ECmeNiDjUWs71VbAz1usqwe1YmiZFKNj7AEja/3WyYIxyUN3RIy211CcdnAnRmpngfN7EnH8D+lp08NCdZqF6apcOgG9fD/YO0xFRBNEbVRutb1X6yQSDn42jQhMQayqxj4fa1la7zJfcA0d9JIXtMM05XtIxJ6DO4E4ico/2p0= ARC-Authentication-Results: i=1; mx.zohomail.in; dkim=pass header.i=siddh.me; spf=pass smtp.mailfrom=code@siddh.me; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1659619870; s=zmail; d=siddh.me; i=code@siddh.me; h=From:From:To:To:Cc:Cc:Message-ID:Subject:Subject:Date:Date:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Content-Type:Message-Id:Reply-To; bh=e1Cbq8k6/3YzM7j1aQGJtFkkIjPn4LJXoM3g2nk5cLE=; b=TerWYYE9ujbbNkLX1KP/NPA7FWH0FshItw90zSI9pMbk5uqbiFZ1MM1QQDmrKo4u rAMb/XAsXRWa62pQNLAz6zHlUwZR3MbC6jxurTeMX83dXLM9NfSw52G00wcN/CTwbCO PMQ2/Jg3nSuX7hYK6hUHIvctRhV44QXAwuqpEUwk= Received: from localhost.localdomain (103.250.137.206 [103.250.137.206]) by mx.zoho.in with SMTPS id 1659619868551234.07828767217745; Thu, 4 Aug 2022 19:01:08 +0530 (IST) From: Siddh Raman Pant To: Eric Biggers , Jonathan Corbet , David Howells , Randy Dunlap , Mauro Carvalho Chehab , Christophe JAILLET , Eric Dumazet Cc: linux-kernel , linux-kernel-mentees Message-ID: Subject: [PATCH 3/3] kernel/watch_queue: Remove wqueue->defunct and use pipe for clear check Date: Thu, 4 Aug 2022 19:00:24 +0530 X-Mailer: git-send-email 2.35.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" The sole use of wqueue->defunct is for checking if the watch queue has been cleared, but wqueue->pipe is also NULL'd while clearing. Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked for NULL. Signed-off-by: Siddh Raman Pant --- include/linux/watch_queue.h | 3 +-- kernel/watch_queue.c | 14 +++++--------- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h index c99c39ec6548..2a3b318db49d 100644 --- a/include/linux/watch_queue.h +++ b/include/linux/watch_queue.h @@ -55,7 +55,7 @@ struct watch_filter { * * @rcu: RCU head * @filter: Filter on watch_notification::info - * @pipe: The pipe we're using as a buffer. + * @pipe: The pipe we're using as a buffer, NULL when queue is cleared/clo= sed * @watches: Contributory watches * @notes: Preallocated notifications * @notes_bitmap: Allocation bitmap for notes @@ -63,7 +63,6 @@ struct watch_filter { * @lock: Spinlock * @nr_notes: Number of notes * @nr_pages: Number of pages in notes[] - * @defunct: True when queues closed */ struct watch_queue { struct rcu_head rcu; diff --git a/kernel/watch_queue.c b/kernel/watch_queue.c index 8999c4e3076d..c63b128818f4 100644 --- a/kernel/watch_queue.c +++ b/kernel/watch_queue.c @@ -43,7 +43,7 @@ MODULE_LICENSE("GPL"); static inline bool lock_wqueue(struct watch_queue *wqueue) { spin_lock_bh(&wqueue->lock); - if (unlikely(wqueue->defunct)) { + if (unlikely(READ_ONCE(wqueue->pipe) =3D=3D NULL)) { spin_unlock_bh(&wqueue->lock); return false; } @@ -99,15 +99,12 @@ static bool post_one_notification(struct watch_queue *w= queue, struct watch_notification *n) { void *p; - struct pipe_inode_info *pipe =3D READ_ONCE(wqueue->pipe); + struct pipe_inode_info *pipe =3D wqueue->pipe; struct pipe_buffer *buf; struct page *page; unsigned int head, tail, mask, note, offset, len; bool done =3D false; =20 - if (!pipe) - return false; - spin_lock_irq(&pipe->rd_wait.lock); =20 mask =3D pipe->ring_size - 1; @@ -603,10 +600,9 @@ void watch_queue_clear(struct watch_queue *wqueue) rcu_read_lock(); spin_lock_bh(&wqueue->lock); =20 - /* Prevent new notifications from being stored. */ - wqueue->defunct =3D true; - - /* This pipe will get freed by caller, and we are anyways clearing. */ + /* This pipe will get freed by the caller free_pipe_info(). + * Removing this reference also prevents new notifications. + */ wqueue->pipe =3D NULL; =20 while (!hlist_empty(&wqueue->watches)) { --=20 2.35.1