Andrew Lukoshko
5edaaf4d17
- Drop AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1417), superseded by the RHEL eventpoll series in 211.31.1 - Temporarily drop the rtmutex remove_waiter() fixes (1418, 1420) - Add RHEL 211.31.1 backports recreated from CS10/upstream (1421-1444)
67 lines
2.8 KiB
Diff
67 lines
2.8 KiB
Diff
From eab8e8be1be2430b6712fc1a6c8925d240a40031 Mon Sep 17 00:00:00 2001
|
|
From: Ian Kent <ikent@redhat.com>
|
|
Date: Tue, 16 Jun 2026 16:02:27 +0800
|
|
Subject: [PATCH] eventpoll: refresh eventpoll_release() fast-path comment
|
|
|
|
JIRA: https://redhat.atlassian.net/browse/RHEL-180777
|
|
Upstream status: Linus
|
|
|
|
commit 33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e
|
|
Author: Christian Brauner <brauner@kernel.org>
|
|
Date: Thu Apr 23 11:56:11 2026 +0200
|
|
|
|
eventpoll: refresh eventpoll_release() fast-path comment
|
|
|
|
The old comment justified the lockless READ_ONCE(file->f_ep) check
|
|
with "False positives simply cannot happen because the file is on
|
|
the way to be removed and nobody ( but eventpoll ) has still a
|
|
reference to this file." That reasoning was the root of the UAF
|
|
fixed in "eventpoll: fix ep_remove struct eventpoll / struct file
|
|
UAF": __ep_remove() could clear f_ep while another close raced
|
|
past the fast path and freed the watched eventpoll / recycled the
|
|
struct file slot.
|
|
|
|
With ep_remove() now pinning @file via epi_fget() across the f_ep
|
|
clear and hlist_del_rcu(), the invariant is re-established for the
|
|
right reason: anyone who might clear f_ep holds @file alive for
|
|
the duration, so a NULL observation really does mean no
|
|
concurrent eventpoll path has work left on this file. Refresh the
|
|
comment accordingly so the next reader doesn't inherit the broken
|
|
model.
|
|
|
|
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org
|
|
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
|
|
|
|
Signed-off-by: Ian Kent <ikent@redhat.com>
|
|
|
|
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
|
|
index 0c0d00fcd131..be762281355a 100644
|
|
--- a/include/linux/eventpoll.h
|
|
+++ b/include/linux/eventpoll.h
|
|
@@ -35,12 +35,16 @@ static inline void eventpoll_release(struct file *file)
|
|
{
|
|
|
|
/*
|
|
- * Fast check to avoid the get/release of the semaphore. Since
|
|
- * we're doing this outside the semaphore lock, it might return
|
|
- * false negatives, but we don't care. It'll help in 99.99% of cases
|
|
- * to avoid the semaphore lock. False positives simply cannot happen
|
|
- * because the file in on the way to be removed and nobody ( but
|
|
- * eventpoll ) has still a reference to this file.
|
|
+ * Fast check to skip the slow path in the common case where the
|
|
+ * file was never attached to an epoll. Safe without file->f_lock
|
|
+ * because every f_ep writer excludes a concurrent __fput() on
|
|
+ * @file:
|
|
+ * - ep_insert() requires the file alive (refcount > 0);
|
|
+ * - ep_remove() holds @file pinned via epi_fget() across the
|
|
+ * write;
|
|
+ * - eventpoll_release_file() runs from __fput() itself.
|
|
+ * We are in __fput() here, so none of those can race us: a NULL
|
|
+ * observation truly means no epoll path has work left on @file.
|
|
*/
|
|
if (likely(!READ_ONCE(file->f_ep)))
|
|
return;
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|