linux.git/fs/eventfd.c, branch v6.9

eventfd: strictly check the count parameter of eventfd_write to avoid inputting illegal strings

2024-02-08T09:12:26+00:00

Since eventfd's document has clearly stated: A write(2) call adds
the 8-byte integer value supplied in its buffer to the counter.

However, in the current implementation, the following code snippet
did not cause an error:

	char str[16] = "hello world";
	uint64_t value;
	ssize_t size;
	int fd;

	fd = eventfd(0, 0);
	size = write(fd, &str, strlen(str));
	printf("eventfd: test writing a string, size=%ld\n", size);
	size = read(fd, &value, sizeof(value));
	printf("eventfd: test reading as uint64, size=%ld, valus=0x%lX\n",
	       size, value);

	close(fd);

And its output is:
eventfd: test writing a string, size=8
eventfd: test reading as uint64, size=8, valus=0x6F77206F6C6C6568

By checking whether count is equal to sizeof(ucnt), such errors
could be detected. It also follows the requirements of the manual.

Signed-off-by: Wen Yang 
Link: https://lore.kernel.org/r/tencent_10AAA44731FFFA493F9F5501521F07DD4D0A@qq.com
Cc: Alexander Viro 
Cc: Jens Axboe 
Cc: Christian Brauner 
Cc: Jan Kara 
Cc: David Woodhouse 
Cc: Matthew Wilcox 
Cc: Eric Biggers 
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Christian Brauner

eventfd: move 'eventfd-count' printing out of spinlock

2024-01-23T16:56:29+00:00

When printing eventfd->count, interrupts will be disabled and a spinlock
will be obtained, competing with eventfd_write(). By moving the
"eventfd-count" print out of the spinlock and merging multiple
seq_printf() into one, it could improve a bit, just like timerfd_show().

Signed-off-by: Wen Yang 
Link: https://lore.kernel.org/r/tencent_B0B3D2BD9861FD009E03AB18A81783322709@qq.com
Cc: Alexander Viro 
Cc: Jens Axboe 
Cc: Christian Brauner 
Cc: Christoph Hellwig 
Cc: Dylan Yudaken 
Cc: David Woodhouse 
Cc: Matthew Wilcox 
Cc: Eric Biggers 
Cc: 
Cc: 
Signed-off-by: Christian Brauner

eventfd: add a BUILD_BUG_ON() to ensure consistency between EFD_SEMAPHORE and the uapi

2024-01-22T14:33:36+00:00

introduce a BUILD_BUG_ON to check that the EFD_SEMAPHORE is equal to its
definition in the uapi file, just like EFD_CLOEXEC and EFD_NONBLOCK.

Signed-off-by: Wen Yang 
Link: https://lore.kernel.org/r/tencent_0BAA2DEAF9208D49987457E6583F9BE79507@qq.com
Cc: Alexander Viro 
Cc: Christian Brauner 
Cc: Jens Axboe 
Cc: Jan Kara 
Cc: 
Cc: 
Signed-off-by: Christian Brauner

eventfd: Remove usage of the deprecated ida_simple_xx() API

2023-12-12T13:24:55+00:00

ida_alloc() and ida_free() should be preferred to the deprecated
ida_simple_get() and ida_simple_remove().

This is less verbose.

Signed-off-by: Christophe JAILLET 
Link: https://lore.kernel.org/r/575dcecd51097dd30c5515f9f0ed92076b4ef403.1702229520.git.christophe.jaillet@wanadoo.fr
Reviewed-by: Jan Kara 
Signed-off-by: Christian Brauner

eventfd: make eventfd_signal{_mask}() void

2023-11-28T13:08:46+00:00

No caller care about the return value.

Link: https://lore.kernel.org/r/20231122-vfs-eventfd-signal-v2-4-bd549b14ce0c@kernel.org
Reviewed-by: Jan Kara 
Reviewed-by: Jens Axboe 
Signed-off-by: Christian Brauner

eventfd: simplify eventfd_signal_mask()

2023-11-28T13:08:46+00:00

The eventfd_signal_mask() helper was introduced for io_uring and similar
to eventfd_signal() it always passed 1 for @n. So don't bother with that
argument at all.

Link: https://lore.kernel.org/r/20231122-vfs-eventfd-signal-v2-3-bd549b14ce0c@kernel.org
Reviewed-by: Jan Kara 
Reviewed-by: Jens Axboe 
Signed-off-by: Christian Brauner

eventfd: simplify eventfd_signal()

2023-11-28T13:08:38+00:00

Ever since the eventfd type was introduced back in 2007 in commit
e1ad7468c77d ("signal/timer/event: eventfd core") the eventfd_signal()
function only ever passed 1 as a value for @n. There's no point in
keeping that additional argument.

Link: https://lore.kernel.org/r/20231122-vfs-eventfd-signal-v2-2-bd549b14ce0c@kernel.org
Acked-by: Xu Yilun 
Acked-by: Andrew Donnellan  # ocxl
Acked-by: Eric Farman   # s390
Reviewed-by: Jan Kara 
Reviewed-by: Jens Axboe 
Signed-off-by: Christian Brauner

eventfd: prevent underflow for eventfd semaphores

2023-07-11T09:41:34+00:00

For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling
eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX.

An underflow can happen with EFD_SEMAPHORE eventfds in at least the
following three subsystems:

(1) virt/kvm/eventfd.c
(2) drivers/vfio/virqfd.c
(3) drivers/virt/acrn/irqfd.c

where (2) and (3) are just modeled after (1). An eventfd must be
specified for use with the KVM_IRQFD ioctl(). This can also be an
EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been
decremented to zero an underflow can be triggered when the irqfd is shut
down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD
ioctl():

        // ctx->count == 0
        kvm_vm_ioctl()
        -> kvm_irqfd()
           -> kvm_irqfd_deassign()
              -> irqfd_deactivate()
                 -> irqfd_shutdown()
                    -> eventfd_ctx_remove_wait_queue(&cnt)
                       -> eventfd_ctx_do_read(&cnt)

Userspace polling on the eventfd wouldn't notice the underflow because 1
is always returned as the value from eventfd_read() while ctx->count
would've underflowed. It's not a huge deal because this should only be
happening when the irqfd is shutdown but we should still fix it and
avoid the spurious wakeup.

Fixes: cb289d6244a3 ("eventfd - allow atomic read and waitqueue remove")
Signed-off-by: Wen Yang 
Cc: Alexander Viro 
Cc: Jens Axboe 
Cc: Christian Brauner 
Cc: Christoph Hellwig 
Cc: Dylan Yudaken 
Cc: David Woodhouse 
Cc: Matthew Wilcox 
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: 
[brauner: rewrite commit message and add explanation how this underflow can happen]
Signed-off-by: Christian Brauner

eventfd: show the EFD_SEMAPHORE flag in fdinfo

2023-06-15T07:22:23+00:00

The EFD_SEMAPHORE flag should be displayed in fdinfo,
as different value could affect the behavior of eventfd.

Suggested-by: Christian Brauner 
Signed-off-by: Wen Yang 
Cc: Alexander Viro 
Cc: Jens Axboe 
Cc: Christian Brauner 
Cc: Christoph Hellwig 
Cc: Dylan Yudaken 
Cc: David Woodhouse 
Cc: Matthew Wilcox 
Cc: Eric Biggers 
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: 
Signed-off-by: Christian Brauner

fs: use correct __poll_t type

2023-05-15T07:33:09+00:00

Fix the following sparse warnings by using __poll_t instead
of unsigned type.

fs/eventpoll.c:541:9: sparse: warning: restricted __poll_t degrades to integer
fs/eventfd.c:67:17: sparse: warning: restricted __poll_t degrades to integer

Signed-off-by: Min-Hua Chen 
Message-Id: <20230511164628.336586-1-minhuadotchen@gmail.com>
Signed-off-by: Christian Brauner