github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-13 00:28:54 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

eventpoll: split __ep_remove()

Browse Source 
Split __ep_remove() to delineate file removal from epoll item removal.

Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner 2026-04-23 11:56:05 +02:00
parent 3d9fd0abc9
commit 0f7bdfd413
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 23 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
fs/eventpoll.c
View File

@ -826,6 +826,9 @@ static void ep_free(struct eventpoll *ep)
kfree_rcu(ep, rcu);
}
static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file);
static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi);
/*
* Removes a "struct epitem" from the eventpoll RB tree and deallocates
* all the associated resources. Must be called with "mtx" held.
@ -837,8 +840,6 @@ static void ep_free(struct eventpoll *ep)
static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
{
struct file *file = epi->ffd.file;
struct epitems_head *to_free;
struct hlist_head *head;
lockdep_assert_irqs_enabled();
@ -854,8 +855,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
return false;
}
to_free = NULL;
head = file->f_ep;
__ep_remove_file(ep, epi, file);
return __ep_remove_epi(ep, epi);
}
/*
* Called with &file->f_lock held,
* returns with it released
*/
static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file)
{
struct epitems_head *to_free = NULL;
struct hlist_head *head = file->f_ep;
lockdep_assert_held(&ep->mtx);
if (hlist_is_singular_node(&epi->fllink, head)) {
/* See eventpoll_release() for details. */
WRITE_ONCE(file->f_ep, NULL);
@ -869,6 +883,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)
hlist_del_rcu(&epi->fllink);
spin_unlock(&file->f_lock);
free_ephead(to_free);
}
static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
{
lockdep_assert_held(&ep->mtx);
rb_erase_cached(&epi->rbn, &ep->rbr);