vfs: clear temporary notReady lists

`EpollInstance.Readiness()` and `EpollInstance.ReadEvents()` queue not-ready
`epollInterest`s on temporary lists named `notReady`, so that they can be
rechecked (with `EpollInstance.readyMu` locked) for concurrent
`epollInterest.NotifyEvents()` before returning. When `epollInterest`s have
*not* been concurrently notified, they are left on the `notReady` list, which
is discarded when the containing function returns.

However, since `notReady` is an intrusive linked list, this means that
not-ready `epollInterest`s can retain pointers to other not-ready
`epollInterest`s in `epollInterest.epollInterestEntry.Prev/Next`. If a
not-ready `epollInterest` is deleted (because e.g. its corresponding
`FileDescription` reaches zero references), but another live `epollInterest`
has a pointer to the deleted `epollInterest`, then the deleted `epollInterest`
will be preserved by save/restore; after restore, `epollInterest.afterLoad()`
will cause the deleted `epollInterest` to be marked ready again, causing it to
be incorrectly polled by the first post-restore call to
`EpollInstance.Readiness()` or `EpollInstance.ReadEvents()` on the affected
`EpollInstance`.

Fix this by unconditionally removing `epollInterest`s from `notReady` lists. As
an additional defensive measure, skip `epollInterest.afterLoad()` for deleted
`epollInterest`s.

PiperOrigin-RevId: 892621271

Author: nixprime

pkg/sentry/vfs/epoll.go

@@ -97,7 +97,8 @@ type epollInterest struct {
 	waiter waiter.Entry
 
 	// mask is the event mask associated with this registration, including
-	// flags EPOLLET and EPOLLONESHOT. mask is protected by epoll.interestMu.
+	// flags EPOLLET and EPOLLONESHOT. If mask is 0, the epollInterest has been
+	// deleted. mask is protected by epoll.interestMu.
 	mask uint32
 
 	// ready is true if epollInterestEntry is linked into epoll.ready. readySeq
@@ -137,10 +138,11 @@ func (ep *EpollInstance) Release(ctx context.Context) {
 	defer ep.interestMu.Unlock()
 	for key, epi := range ep.interest {
 		file := key.file
+		file.EventUnregister(&epi.waiter)
+		epi.mask = 0
 		file.epollMu.Lock()
 		delete(file.epolls, epi)
 		file.epollMu.Unlock()
-		file.EventUnregister(&epi.waiter)
 	}
 	ep.interest = nil
 }
@@ -177,9 +179,9 @@ func (ep *EpollInstance) Readiness(mask waiter.EventMask) waiter.EventMask {
 		var next *epollInterest
 		for epi := notReady.Front(); epi != nil; epi = next {
 			next = epi.Next()
+			notReady.Remove(epi)
 			if epi.readySeq == ep.readySeq {
 				// epi.NotifyEvent() was called while we were running.
-				notReady.Remove(epi)
 				ep.ready.PushBack(epi)
 				notify = true
 			} else {
@@ -402,6 +404,7 @@ func (epi *epollInterest) NotifyEvent(waiter.EventMask) {
 // Preconditions: ep.interestMu must be locked.
 func (ep *EpollInstance) removeLocked(epi *epollInterest) {
 	delete(ep.interest, epi.key)
+	epi.mask = 0
 	ep.readyMu.Lock()
 	if epi.ready {
 		epi.ready = false
@@ -443,9 +446,9 @@ func (ep *EpollInstance) ReadEvents(events []linux.EpollEvent, maxEvents int) []
 		var next *epollInterest
 		for epi := notReady.Front(); epi != nil; epi = next {
 			next = epi.Next()
+			notReady.Remove(epi)
 			if epi.readySeq == ep.readySeq {
 				// epi.NotifyEvent() was called while we were running.
-				notReady.Remove(epi)
 				ep.ready.PushBack(epi)
 				notify = true
 			} else {

pkg/sentry/vfs/save_restore.go

@@ -185,5 +185,7 @@ func (mnt *Mount) afterLoad(goContext.Context) {
 func (epi *epollInterest) afterLoad(goContext.Context) {
 	// Mark all epollInterests as ready after restore so that the next call to
 	// EpollInstance.ReadEvents() rechecks their readiness.
-	epi.waiter.NotifyEvent(waiter.EventMaskFromLinux(epi.mask))
+	if epi.mask != 0 {
+		epi.waiter.NotifyEvent(waiter.EventMaskFromLinux(epi.mask))
+	}
 }