From 9f2b8f4a452db79741c06e6ea91448347f4a975c Mon Sep 17 00:00:00 2001 From: Tianyi Chen Date: Mon, 19 Oct 2026 18:39:27 +0900 Subject: [PATCH] eventpoll: propagate wakeup source creation failure in ep_modify() When EPOLL_CTL_MOD adds EPOLLWAKEUP, ep_modify() ignores the return value of ep_create_wakeup_source(). If allocation fails, it returns success with EPOLLWAKEUP set but no per-item wakeup source, so the requested suspend protection is missing. This can happen without fault injection on SELinux systems: creating the wakeup source's sysfs nodes can require GFP_KERNEL_ACCOUNT allocations for security.selinux xattrs, which can fail when the caller's memory cgroup is over its limit. Create the wakeup source before updating the event mask and data, and return the error if creation fails. Leave any newly created per-epoll source in place until ep_free(), as ep_insert() does on failure. Fixes: 4d7e30d98939 ("epoll: Add a flag, EPOLLWAKEUP, to prevent suspend while epoll events are ready") Signed-off-by: Tianyi Chen Link: https://patch.msgid.link/179240281988.1700986.8309527041821666235@tychen.cc Signed-off-by: Christian Brauner (Amutable) --- fs/eventpoll.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index f48b829a710f..7a32c70bf2ad 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1982,11 +1982,22 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, { int pwake = 0; poll_table pt; + int error; lockdep_assert_irqs_enabled(); init_poll_funcptr(&pt, NULL); + /* + * Create the wakeup source before committing the new event mask. + * Leave the old mask and data unchanged if allocation fails. + */ + if ((event->events & EPOLLWAKEUP) && !ep_has_wakeup_source(epi)) { + error = ep_create_wakeup_source(epi); + if (error) + return error; + } + /* * Set the new event interest mask before calling f_op->poll(); * otherwise we might miss an event that happens between the @@ -1994,12 +2005,9 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, */ epi->event.events = event->events; /* need barrier below */ epi->event.data = event->data; /* protected by mtx */ - if (epi->event.events & EPOLLWAKEUP) { - if (!ep_has_wakeup_source(epi)) - ep_create_wakeup_source(epi); - } else if (ep_has_wakeup_source(epi)) { + if (!(epi->event.events & EPOLLWAKEUP) && + ep_has_wakeup_source(epi)) ep_destroy_wakeup_source(epi); - } /* * The following barrier has two effects: