Andrew Lukoshko
5edaaf4d17
- Drop AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417), superseded by the RHEL eventpoll series in 211.31.1 - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - Add RHEL 211.31.1 backports recreated from CS10/upstream (1421-1444)
96 lines
2.8 KiB
Diff
96 lines
2.8 KiB
Diff
From 38a78d49b434ce9f29afdfaa870142ecb121800f Mon Sep 17 00:00:00 2001
|
|
From: Ian Kent <ikent@redhat.com>
|
|
Date: Tue, 16 Jun 2026 16:03:04 +0800
|
|
Subject: [PATCH] eventpoll: drop dead bool return from ep_remove_epi()
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-180777
|
|
Upstream status: Linus
|
|
|
|
commit 3a4551ea9c042502019b1d8a986e962cb9015366
|
|
Author: Christian Brauner <brauner@kernel.org>
|
|
Date: Thu Apr 23 11:56:12 2026 +0200
|
|
|
|
eventpoll: drop dead bool return from ep_remove_epi()
|
|
|
|
ep_remove_epi() always returns true -- the "can be disposed"
|
|
answer was meaningful back when the dying-check lived inside the
|
|
pre-split __ep_remove(), but after that check moved to ep_remove()
|
|
the return value is just noise. Both callers gate on it
|
|
unconditionally:
|
|
|
|
if (ep_remove_epi(ep, epi))
|
|
WARN_ON_ONCE(ep_refcount_dec_and_test(ep));
|
|
|
|
dispose = ep_remove_epi(ep, epi);
|
|
...
|
|
if (dispose && ep_refcount_dec_and_test(ep))
|
|
ep_free(ep);
|
|
|
|
Make ep_remove_epi() return void, drop the dispose local in
|
|
eventpoll_release_file(), and the useless conditionals at both
|
|
callers. No functional change.
|
|
|
|
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-9-2470f9eec0f5@kernel.org
|
|
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
|
|
Signed-off-by: Ian Kent <ikent@redhat.com>
|
|
|
|
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
|
|
index 9798ab5f7663..761bd85f213e 100644
|
|
--- a/fs/eventpoll.c
|
|
+++ b/fs/eventpoll.c
|
|
@@ -881,7 +881,7 @@ static void ep_remove_file(struct eventpoll *ep, struct epitem *epi,
|
|
free_ephead(to_free);
|
|
}
|
|
|
|
-static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
|
|
+static void ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
|
|
{
|
|
lockdep_assert_held(&ep->mtx);
|
|
|
|
@@ -903,7 +903,6 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
|
|
kfree_rcu(epi, rcu);
|
|
|
|
percpu_counter_dec(&ep->user->epoll_watches);
|
|
- return true;
|
|
}
|
|
|
|
/*
|
|
@@ -931,9 +930,8 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi)
|
|
return;
|
|
|
|
ep_remove_file(ep, epi, file);
|
|
-
|
|
- if (ep_remove_epi(ep, epi))
|
|
- WARN_ON_ONCE(ep_refcount_dec_and_test(ep));
|
|
+ ep_remove_epi(ep, epi);
|
|
+ WARN_ON_ONCE(ep_refcount_dec_and_test(ep));
|
|
}
|
|
|
|
static void ep_clear_and_put(struct eventpoll *ep)
|
|
@@ -1125,7 +1123,6 @@ void eventpoll_release_file(struct file *file)
|
|
{
|
|
struct eventpoll *ep;
|
|
struct epitem *epi;
|
|
- bool dispose;
|
|
|
|
/*
|
|
* Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from
|
|
@@ -1149,11 +1146,11 @@ void eventpoll_release_file(struct file *file)
|
|
ep_unregister_pollwait(ep, epi);
|
|
|
|
ep_remove_file(ep, epi, file);
|
|
- dispose = ep_remove_epi(ep, epi);
|
|
+ ep_remove_epi(ep, epi);
|
|
|
|
mutex_unlock(&ep->mtx);
|
|
|
|
- if (dispose && ep_refcount_dec_and_test(ep))
|
|
+ if (ep_refcount_dec_and_test(ep))
|
|
ep_free(ep);
|
|
goto again;
|
|
}
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|