Andrew Lukoshko
5edaaf4d17
- Drop AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417), superseded by the RHEL eventpoll series in 211.31.1 - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - Add RHEL 211.31.1 backports recreated from CS10/upstream (1421-1444)
67 lines
2.3 KiB
Diff
67 lines
2.3 KiB
Diff
From bde1be0c6e5eeb145576344159be1f51cb8d5d8b Mon Sep 17 00:00:00 2001
|
|
From: Ian Kent <ikent@redhat.com>
|
|
Date: Tue, 16 Jun 2026 15:53:22 +0800
|
|
Subject: [PATCH] epoll: annotate racy check
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-180777
|
|
Upstream status: Linus
|
|
|
|
commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a
|
|
Author: Christian Brauner <brauner@kernel.org>
|
|
Date: Wed Sep 25 11:05:16 2024 +0200
|
|
|
|
epoll: annotate racy check
|
|
|
|
Epoll relies on a racy fastpath check during __fput() in
|
|
eventpoll_release() to avoid the hit of pointlessly acquiring a
|
|
semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE().
|
|
|
|
Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com
|
|
Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner
|
|
Reviewed-by: Jan Kara <jack@suse.cz>
|
|
Reported-by: syzbot+3b6b32dc50537a49bb4a@syzkaller.appspotmail.com
|
|
Signed-off-by: Christian Brauner <brauner@kernel.org>
|
|
|
|
Signed-off-by: Ian Kent <ikent@redhat.com>
|
|
|
|
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
|
|
index a7efeb499e4b..616f97e9b75b 100644
|
|
--- a/fs/eventpoll.c
|
|
+++ b/fs/eventpoll.c
|
|
@@ -852,7 +852,8 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
|
|
to_free = NULL;
|
|
head = file->f_ep;
|
|
if (head->first == &epi->fllink && !epi->fllink.next) {
|
|
- file->f_ep = NULL;
|
|
+ /* See eventpoll_release() for details. */
|
|
+ WRITE_ONCE(file->f_ep, NULL);
|
|
if (!is_file_epoll(file)) {
|
|
struct epitems_head *v;
|
|
v = container_of(head, struct epitems_head, epitems);
|
|
@@ -1630,7 +1631,8 @@ static int attach_epitem(struct file *file, struct epitem *epi)
|
|
spin_unlock(&file->f_lock);
|
|
goto allocate;
|
|
}
|
|
- file->f_ep = head;
|
|
+ /* See eventpoll_release() for details. */
|
|
+ WRITE_ONCE(file->f_ep, head);
|
|
to_free = NULL;
|
|
}
|
|
hlist_add_head_rcu(&epi->fllink, file->f_ep);
|
|
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
|
|
index 3337745d81bd..0c0d00fcd131 100644
|
|
--- a/include/linux/eventpoll.h
|
|
+++ b/include/linux/eventpoll.h
|
|
@@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file)
|
|
* because the file in on the way to be removed and nobody ( but
|
|
* eventpoll ) has still a reference to this file.
|
|
*/
|
|
- if (likely(!file->f_ep))
|
|
+ if (likely(!READ_ONCE(file->f_ep)))
|
|
return;
|
|
|
|
/*
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|