Andrew Lukoshko
2042c1b105
- Drop AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712), superseded by the RHEL eventpoll series in 687.23.1 - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) - Add RHEL 687.23.1 backports recreated from CS10/upstream (1739-1755)
85 lines
2.5 KiB
Diff
85 lines
2.5 KiB
Diff
From 83db11e5ba3c57104945247e11c1891355a12fb6 Mon Sep 17 00:00:00 2001
|
|
From: Ian Kent <ikent@redhat.com>
|
|
Date: Tue, 16 Jun 2026 15:55:51 +0800
|
|
Subject: [PATCH] eventpoll: split __ep_remove()
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-180777
|
|
Upstream status: Linus
|
|
|
|
commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0
|
|
Author: Christian Brauner <brauner@kernel.org>
|
|
Date: Thu Apr 23 11:56:05 2026 +0200
|
|
|
|
eventpoll: split __ep_remove()
|
|
|
|
Split __ep_remove() to delineate file removal from epoll item removal.
|
|
|
|
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org
|
|
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
|
|
Signed-off-by: Ian Kent <ikent@redhat.com>
|
|
|
|
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
|
|
index 2dd87800bfbf..001c87b6ddab 100644
|
|
--- a/fs/eventpoll.c
|
|
+++ b/fs/eventpoll.c
|
|
@@ -825,6 +825,9 @@ static void ep_free(struct eventpoll *ep)
|
|
kfree_rcu(ep, rcu);
|
|
}
|
|
|
|
+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file);
|
|
+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi);
|
|
+
|
|
/*
|
|
* Removes a "struct epitem" from the eventpoll RB tree and deallocates
|
|
* all the associated resources. Must be called with "mtx" held.
|
|
@@ -836,8 +839,6 @@ static void ep_free(struct eventpoll *ep)
|
|
static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
|
|
{
|
|
struct file *file = epi->ffd.file;
|
|
- struct epitems_head *to_free;
|
|
- struct hlist_head *head;
|
|
|
|
lockdep_assert_irqs_enabled();
|
|
|
|
@@ -853,8 +854,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
|
|
return false;
|
|
}
|
|
|
|
- to_free = NULL;
|
|
- head = file->f_ep;
|
|
+ __ep_remove_file(ep, epi, file);
|
|
+ return __ep_remove_epi(ep, epi);
|
|
+}
|
|
+
|
|
+/*
|
|
+ * Called with &file->f_lock held,
|
|
+ * returns with it released
|
|
+ */
|
|
+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file)
|
|
+{
|
|
+ struct epitems_head *to_free = NULL;
|
|
+ struct hlist_head *head = file->f_ep;
|
|
+
|
|
+ lockdep_assert_held(&ep->mtx);
|
|
+
|
|
if (hlist_is_singular_node(&epi->fllink, head)) {
|
|
/* See eventpoll_release() for details. */
|
|
WRITE_ONCE(file->f_ep, NULL);
|
|
@@ -868,6 +882,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
|
|
hlist_del_rcu(&epi->fllink);
|
|
spin_unlock(&file->f_lock);
|
|
free_ephead(to_free);
|
|
+}
|
|
+
|
|
+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
|
|
+{
|
|
+ lockdep_assert_held(&ep->mtx);
|
|
|
|
rb_erase_cached(&epi->rbn, &ep->rbr);
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|