github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

eventpoll: defer struct eventpoll free to RCU grace period

Browse Source 
In certain situations, ep_free() in eventpoll.c will kfree the epi->ep
eventpoll struct while it still being used by another concurrent thread.
Defer the kfree() to an RCU callback to prevent UAF.

Fixes: f2e467a482 ("eventpoll: Fix semi-unbounded recursion")
Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
This commit is contained in:
Nicholas Carlini 2026-03-31 15:25:32 +02:00 committed by Christian Brauner
parent 1635c2acdd
commit 07712db808
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 5 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
fs/eventpoll.c
View File

@ -226,6 +226,9 @@ struct eventpoll {
*/ */
refcount_t refcount; refcount_t refcount;
/* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */
struct rcu_head rcu;
#ifdef CONFIG_NET_RX_BUSY_POLL #ifdef CONFIG_NET_RX_BUSY_POLL
/* used to track busy poll napi_id */ /* used to track busy poll napi_id */
unsigned int napi_id; unsigned int napi_id;
@ -819,7 +822,8 @@ static void ep_free(struct eventpoll *ep)
mutex_destroy(&ep->mtx); mutex_destroy(&ep->mtx);
free_uid(ep->user); free_uid(ep->user);
wakeup_source_unregister(ep->ws); wakeup_source_unregister(ep->ws);
kfree(ep); /* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */
kfree_rcu(ep, rcu);
} }
/* /*