diff options
| author | Christian Brauner <brauner@kernel.org> | 2026-06-26 12:13:58 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:42:22 +0200 |
| commit | 903070f8f3552fdef0d8b6c0d94fc6ea5ade7c73 (patch) | |
| tree | 06b993bd5ef91860a4c42c001a4ffe45b78daabf | |
| parent | ff4fe83a9aabbe4d1ea20b6cf38c572b60201c9b (diff) | |
| download | linux-stable-903070f8f3552fdef0d8b6c0d94fc6ea5ade7c73.tar.gz linux-stable-903070f8f3552fdef0d8b6c0d94fc6ea5ade7c73.zip | |
eventpoll: split __ep_remove()
[ Upstream commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 ]
Split __ep_remove() to delineate file removal from epoll item removal.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Stable-dep-of: a6dc643c6931 ("eventpoll: fix ep_remove struct eventpoll / struct file UAF")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/eventpoll.c | 27 |
1 files changed, 23 insertions, 4 deletions
diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 4f05d12a0503..ae9cb8276448 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -715,6 +715,9 @@ static void ep_free(struct eventpoll *ep) kfree_rcu(ep, rcu); } +static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); +static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); + /* * Removes a "struct epitem" from the eventpoll RB tree and deallocates * all the associated resources. Must be called with "mtx" held. @@ -726,8 +729,6 @@ static void ep_free(struct eventpoll *ep) static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) { struct file *file = epi->ffd.file; - struct epitems_head *to_free; - struct hlist_head *head; lockdep_assert_irqs_enabled(); @@ -743,8 +744,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) return false; } - to_free = NULL; - head = file->f_ep; + __ep_remove_file(ep, epi, file); + return __ep_remove_epi(ep, epi); +} + +/* + * Called with &file->f_lock held, + * returns with it released + */ +static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) +{ + struct epitems_head *to_free = NULL; + struct hlist_head *head = file->f_ep; + + lockdep_assert_held(&ep->mtx); + if (hlist_is_singular_node(&epi->fllink, head)) { /* See eventpoll_release() for details. */ WRITE_ONCE(file->f_ep, NULL); @@ -758,6 +772,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) hlist_del_rcu(&epi->fllink); spin_unlock(&file->f_lock); free_ephead(to_free); +} + +static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) +{ + lockdep_assert_held(&ep->mtx); rb_erase_cached(&epi->rbn, &ep->rbr); |