eventfd: track eventfd_signal() recursion depth
authorJens Axboe <axboe@kernel.dk>
Sun, 2 Feb 2020 15:23:03 +0000 (08:23 -0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 11 Feb 2020 12:34:08 +0000 (04:34 -0800)
commiteaef83c4c0cb8c82ab7cea99479d49d35a5cd25d
tree4f5837096454967295249bde5c311130ac6a4865
parente608cd92bac3a37436666b75e7272af968ebbbc5
eventfd: track eventfd_signal() recursion depth

commit b5e683d5cab8cd433b06ae178621f083cabd4f63 upstream.

eventfd use cases from aio and io_uring can deadlock due to circular
or resursive calling, when eventfd_signal() tries to grab the waitqueue
lock. On top of that, it's also possible to construct notification
chains that are deep enough that we could blow the stack.

Add a percpu counter that tracks the percpu recursion depth, warn if we
exceed it. The counter is also exposed so that users of eventfd_signal()
can do the right thing if it's non-zero in the context where it is
called.

Cc: stable@vger.kernel.org # 4.19+
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/eventfd.c
include/linux/eventfd.h