[PATCH v2] kernfs: fix deadlock in epoll_ctl by waking pollfree

[PATCH v2] kernfs: fix deadlock in epoll_ctl by waking pollfree

[Sainath Manda]

Syzbot reported a task hung in do_epoll_ctl_file(). This is caused by an
AB-BA lock inversion between epoll's ep->mtx and kernfs node teardown.

Thread A (epoll_ctl) acquires ep->mtx, then attempts to acquire the
kernfs active reference during vfs_poll().
Thread B (kernfs_remove) deactivates the node and attempts to unhook
active epoll monitors, which requires ep->mtx.

This patch fixes the deadlock by utilizing the existing epoll POLLFREE
path. By calling wake_up_pollfree(&on->poll) before the waitqueue is
freed, epoll users are notified to detach their wait entries without
requiring kernfs teardown to acquire ep->mtx.

Reported-by: syzbot+f83fa2cf571bd7650422@syzkaller.appspotmail.com
Signed-off-by: Sainath Manda <sainathmanda777@gmail.com>
---
 fs/kernfs/file.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 1163aa769..db3fed4d7 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -600,6 +600,14 @@ static void kernfs_unlink_open_file(struct kernfs_node *kn,
 	}
 
 	if (list_empty(&on->files)) {
+		/*
+		 * @on->poll is embedded in @on and is about to be freed.  Tell
+		 * epoll users to detach their wait entries through the POLLFREE
+		 * callback path before the waitqueue disappears.  This path is
+		 * serialized by the waitqueue lock and doesn't require taking
+		 * eventpoll's ep->mtx from kernfs teardown.
+		 */
+		wake_up_pollfree(&on->poll);
 		rcu_assign_pointer(kn->attr.open, NULL);
 		kfree_rcu(on, rcu_head);
 	}
-- 
2.34.1

Re: [PATCH v2] kernfs: fix deadlock in epoll_ctl by waking pollfree

[Greg KH]

On Sun, Jun 21, 2026 at 04:13:10PM +0530, Sainath Manda wrote:
> Syzbot reported a task hung in do_epoll_ctl_file(). This is caused by an
> AB-BA lock inversion between epoll's ep->mtx and kernfs node teardown.
> 
> Thread A (epoll_ctl) acquires ep->mtx, then attempts to acquire the
> kernfs active reference during vfs_poll().
> Thread B (kernfs_remove) deactivates the node and attempts to unhook
> active epoll monitors, which requires ep->mtx.
> 
> This patch fixes the deadlock by utilizing the existing epoll POLLFREE
> path. By calling wake_up_pollfree(&on->poll) before the waitqueue is
> freed, epoll users are notified to detach their wait entries without
> requiring kernfs teardown to acquire ep->mtx.
> 
> Reported-by: syzbot+f83fa2cf571bd7650422@syzkaller.appspotmail.com
> Signed-off-by: Sainath Manda <sainathmanda777@gmail.com>
> ---
>  fs/kernfs/file.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

What commit id does this fix?  And why isn't it for stable kernels too?

thanks,

greg k-h