pipe: wakeup wr_wait after setting max_usage

Upstream Status: linux.git
JIRA: https://issues.redhat.com/browse/RHEL-37087
CVE: CVE-2023-52672

commit e95aada
Author: Lukas Schauer <lukas@schauer.dev>
Date:   Fri Dec 1 11:11:28 2023 +0100

    pipe: wakeup wr_wait after setting max_usage

    Commit c73be61 ("pipe: Add general notification queue support") a
    regression was introduced that would lock up resized pipes under certain
    conditions. See the reproducer in [1].

    The commit resizing the pipe ring size was moved to a different
    function, doing that moved the wakeup for pipe->wr_wait before actually
    raising pipe->max_usage. If a pipe was full before the resize occured it
    would result in the wakeup never actually triggering pipe_write.

    Set @max_usage and @nr_accounted before waking writers if this isn't a
    watch queue.

    Link: https://bugzilla.kernel.org/show_bug.cgi?id=212295 [1]
    Link: https://lore.kernel.org/r/20231201-orchideen-modewelt-e009de4562c6@brauner
    Fixes: c73be61 ("pipe: Add general notification queue support")
    Reviewed-by: David Howells <dhowells@redhat.com>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Lukas Schauer <lukas@schauer.dev>
    [Christian Brauner <brauner@kernel.org>: rewrite to account for watch queues]
    Signed-off-by: Christian Brauner <brauner@kernel.org>

Signed-off-by: Brian Foster <bfoster@redhat.com>

Author: Brian Foster

fs/pipe.c

@@ -1313,6 +1313,11 @@ int pipe_resize_ring(struct pipe_inode_info *pipe, unsigned int nr_slots)
 	pipe->tail = tail;
 	pipe->head = head;
 
+	if (!pipe_has_watch_queue(pipe)) {
+		pipe->max_usage = nr_slots;
+		pipe->nr_accounted = nr_slots;
+	}
+
 	spin_unlock_irq(&pipe->rd_wait.lock);
 
 	/* This might have made more room for writers */
@@ -1364,8 +1369,6 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long arg)
 	if (ret < 0)
 		goto out_revert_acct;
 
-	pipe->max_usage = nr_slots;
-	pipe->nr_accounted = nr_slots;
 	return pipe->max_usage * PAGE_SIZE;
 
 out_revert_acct: