Re: [PATCH v2] kernfs: fix deadlock in epoll_ctl by waking pollfree

[Greg KH <gregkh@linuxfoundation.org>]

On Sun, Jun 21, 2026 at 04:13:10PM +0530, Sainath Manda wrote:
> Syzbot reported a task hung in do_epoll_ctl_file(). This is caused by an
> AB-BA lock inversion between epoll's ep->mtx and kernfs node teardown.
> 
> Thread A (epoll_ctl) acquires ep->mtx, then attempts to acquire the
> kernfs active reference during vfs_poll().
> Thread B (kernfs_remove) deactivates the node and attempts to unhook
> active epoll monitors, which requires ep->mtx.
> 
> This patch fixes the deadlock by utilizing the existing epoll POLLFREE
> path. By calling wake_up_pollfree(&on->poll) before the waitqueue is
> freed, epoll users are notified to detach their wait entries without
> requiring kernfs teardown to acquire ep->mtx.
> 
> Reported-by: syzbot+f83fa2cf571bd7650422@syzkaller.appspotmail.com
> Signed-off-by: Sainath Manda <sainathmanda777@gmail.com>
> ---
>  fs/kernfs/file.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

What commit id does this fix?  And why isn't it for stable kernels too?

thanks,

greg k-h