[PATCH v2] kernfs: fix deadlock in epoll_ctl by waking pollfree

[Sainath Manda <sainathmanda777@gmail.com>]

Syzbot reported a task hung in do_epoll_ctl_file(). This is caused by an
AB-BA lock inversion between epoll's ep->mtx and kernfs node teardown.

Thread A (epoll_ctl) acquires ep->mtx, then attempts to acquire the
kernfs active reference during vfs_poll().
Thread B (kernfs_remove) deactivates the node and attempts to unhook
active epoll monitors, which requires ep->mtx.

This patch fixes the deadlock by utilizing the existing epoll POLLFREE
path. By calling wake_up_pollfree(&on->poll) before the waitqueue is
freed, epoll users are notified to detach their wait entries without
requiring kernfs teardown to acquire ep->mtx.

Reported-by: syzbot+f83fa2cf571bd7650422@syzkaller.appspotmail.com
Signed-off-by: Sainath Manda <sainathmanda777@gmail.com>
---
 fs/kernfs/file.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 1163aa769..db3fed4d7 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -600,6 +600,14 @@ static void kernfs_unlink_open_file(struct kernfs_node *kn,
 	}
 
 	if (list_empty(&on->files)) {
+		/*
+		 * @on->poll is embedded in @on and is about to be freed.  Tell
+		 * epoll users to detach their wait entries through the POLLFREE
+		 * callback path before the waitqueue disappears.  This path is
+		 * serialized by the waitqueue lock and doesn't require taking
+		 * eventpoll's ep->mtx from kernfs teardown.
+		 */
+		wake_up_pollfree(&on->poll);
 		rcu_assign_pointer(kn->attr.open, NULL);
 		kfree_rcu(on, rcu_head);
 	}
-- 
2.34.1