From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from gabe.freedesktop.org (gabe.freedesktop.org [131.252.210.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id D9598C4345F for ; Fri, 3 May 2024 22:46:29 +0000 (UTC) Received: from gabe.freedesktop.org (localhost [127.0.0.1]) by gabe.freedesktop.org (Postfix) with ESMTP id 4FD6F113309; Fri, 3 May 2024 22:46:29 +0000 (UTC) Authentication-Results: gabe.freedesktop.org; dkim=pass (1024-bit key; unprotected) header.d=chromium.org header.i=@chromium.org header.b="YpiTw6F1"; dkim-atps=neutral Received: from mail-pf1-f182.google.com (mail-pf1-f182.google.com [209.85.210.182]) by gabe.freedesktop.org (Postfix) with ESMTPS id D9933113309 for ; Fri, 3 May 2024 22:46:27 +0000 (UTC) Received: by mail-pf1-f182.google.com with SMTP id d2e1a72fcca58-6ee12766586so136097b3a.0 for ; Fri, 03 May 2024 15:46:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1714776387; x=1715381187; darn=lists.freedesktop.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=mDJm+G1eQTkRtzeGacfCcUIfkVf82OdjbXxPvJWkGL8=; b=YpiTw6F1tWTHfwJ4+c81oTVRV+C4P61AG8OikmDiWyeF4tulPSGyFpyP5g7zN6nl2O 8/CXUOQ/LM0GPfxTm6xDKEq3ks0KE2Fp9aagkb8ZMHSK7T8Tb7ri3meGpzyaOPjWeA1Q siVQAIukeYKVZ4S0UxNScvtVXtM4cXBjiEK1E= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714776387; x=1715381187; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=mDJm+G1eQTkRtzeGacfCcUIfkVf82OdjbXxPvJWkGL8=; b=NTYhUXTHrgyBxSTvgqZB58jBk67ujqsrJUK9OFPyEYACcI34nJ1+dpVbGsP5p8zfID PIRvdla485G2yM9YCuibdWBr0RGJXkqm088Jszf8K6q3XcHz3GKBb8EZ/xYCpvIC/PqZ pDWSH7126Hgg1/JcImb2eQgHcTkax697FYUA51ofNmblQTFvHthwrArbq44M2707Tr/d 53ccVLv+oJRlt4VOhzT797BGYkItolsukgMvkxBDOlzEKWemKrYfMdE/su8KEbZqPVkQ f8af6cxDu2IX4GPzZuNucHCqQPubPw7F2vYmqsBxZ7FgING+BxZWcMu2W62WBZzDNpSf qEVg== X-Forwarded-Encrypted: i=1; AJvYcCVT7J5pC0HN9DeGhjaiGFkzvJtSFdQio6CMOOV5mkChzQNZSn8Z1zIRHxRVWPN8ogGXlBlpADb5OnzwpKOmWimN3V2b6pThgFoRe/arv2qn X-Gm-Message-State: AOJu0YymCZ0KPWlK6zhQirzwPwD6eu/n5lMFk38QE/TDyB7aErdWVTCN W0bchkNQijvJcRzjha5QUKH0+hQsNptj9X7qcQlNMFvO7e8w/yUPcQBhvkYqQA== X-Google-Smtp-Source: AGHT+IGHwRAHiUilkIaBMSgKxfWAn6dj229eadrK2bv8wlplvr3MD06FsL2cYfgcUjeFAYrze9wdSQ== X-Received: by 2002:aa7:88d2:0:b0:6e7:48e3:7895 with SMTP id k18-20020aa788d2000000b006e748e37895mr9433402pff.2.1714776387222; Fri, 03 May 2024 15:46:27 -0700 (PDT) Received: from www.outflux.net ([198.0.35.241]) by smtp.gmail.com with ESMTPSA id w17-20020aa79a11000000b006f4476e078dsm2406826pfj.192.2024.05.03.15.46.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 03 May 2024 15:46:26 -0700 (PDT) Date: Fri, 3 May 2024 15:46:25 -0700 From: Kees Cook To: Linus Torvalds Cc: Al Viro , axboe@kernel.dk, brauner@kernel.org, christian.koenig@amd.com, dri-devel@lists.freedesktop.org, io-uring@vger.kernel.org, jack@suse.cz, laura@labbott.name, linaro-mm-sig@lists.linaro.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, minhquangbui99@gmail.com, sumit.semwal@linaro.org, syzbot+045b454ab35fd82a35fb@syzkaller.appspotmail.com, syzkaller-bugs@googlegroups.com Subject: Re: [PATCH] epoll: try to be a _bit_ better about file lifetimes Message-ID: <202405031529.2CD1BFED37@keescook> References: <202405031110.6F47982593@keescook> <20240503211129.679762-2-torvalds@linux-foundation.org> <20240503212428.GY2118490@ZenIV> <20240503214531.GB2118490@ZenIV> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-BeenThere: dri-devel@lists.freedesktop.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Direct Rendering Infrastructure - Development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dri-devel-bounces@lists.freedesktop.org Sender: "dri-devel" On Fri, May 03, 2024 at 02:52:38PM -0700, Linus Torvalds wrote: > That means that the file will be released - and it means that you have > violated all the refcounting rules for poll(). I feel like I've been looking at this too long. I think I see another problem here, but with dmabuf even when epoll is fixed: dma_buf_poll() get_file(dmabuf->file) /* f_count + 1 */ dma_buf_poll_add_cb() dma_resv_for_each_fence ... dma_fence_add_callback(fence, ..., dma_buf_poll_cb) dma_buf_poll_cb() ... fput(dmabuf->file); /* f_count - 1 ... for each fence */ Isn't it possible to call dma_buf_poll_cb() (and therefore fput()) multiple times if there is more than 1 fence? Perhaps I've missed a place where a single struct dma_resv will only ever signal 1 fence? But looking through dma_fence_signal_timestamp_locked(), I don't see anything about resv nor somehow looking into other fence cb_list contents... -- Kees Cook