diff options
| author | Christian Brauner <brauner@kernel.org> | 2026-06-26 12:13:57 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-07-04 13:42:22 +0200 |
| commit | ff4fe83a9aabbe4d1ea20b6cf38c572b60201c9b (patch) | |
| tree | 4cc93fb190a7ceea353448c17cbcb77c07bbf6b1 | |
| parent | 44e8907b81fea7784b4e6c8aba0d05ec27d4fa2a (diff) | |
| download | linux-ff4fe83a9aabbe4d1ea20b6cf38c572b60201c9b.tar.gz linux-ff4fe83a9aabbe4d1ea20b6cf38c572b60201c9b.zip | |
eventpoll: use hlist_is_singular_node() in __ep_remove()
[ Upstream commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b ]
Replace the open-coded "epi is the only entry in file->f_ep" check
with hlist_is_singular_node(). Same semantics, and the helper avoids
the head-cacheline access in the common false case.
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
Stable-dep-of: a6dc643c6931 ("eventpoll: fix ep_remove struct eventpoll / struct file UAF")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/eventpoll.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 8a556560a5b2..4f05d12a0503 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -745,7 +745,7 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) to_free = NULL; head = file->f_ep; - if (head->first == &epi->fllink && !epi->fllink.next) { + if (hlist_is_singular_node(&epi->fllink, head)) { /* See eventpoll_release() for details. */ WRITE_ONCE(file->f_ep, NULL); if (!is_file_epoll(file)) { |