]> git.baikalelectronics.ru Git - kernel.git/commit
epoll: fix use-after-free in eventpoll_release_file
authorKonstantin Khlebnikov <koct9i@gmail.com>
Tue, 17 Jun 2014 02:58:05 +0000 (06:58 +0400)
committerLinus Torvalds <torvalds@linux-foundation.org>
Tue, 17 Jun 2014 03:21:59 +0000 (17:21 -1000)
commit335487df22a31a430097d64f480aca9b36d734f5
treea428632381694d7de07944ea5398df4dfb20f0e1
parent0835bbab1c12c1673482348606280f80d051f2a3
epoll: fix use-after-free in eventpoll_release_file

This fixes use-after-free of epi->fllink.next inside list loop macro.
This loop actually releases elements in the body.  The list is
rcu-protected but here we cannot hold rcu_read_lock because we need to
lock mutex inside.

The obvious solution is to use list_for_each_entry_safe().  RCU-ness
isn't essential because nobody can change this list under us, it's final
fput for this file.

The bug was introduced by 91c0169067e7 ("epoll: optimize EPOLL_CTL_DEL
using rcu")

Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
Reported-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Stable <stable@vger.kernel.org> # 3.13+
Cc: Sasha Levin <sasha.levin@oracle.com>
Cc: Jason Baron <jbaron@akamai.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/eventpoll.c