Unverified Commit 0bade234 authored by Christian Brauner's avatar Christian Brauner
Browse files

eventpoll: rename ep_remove_safe() back to ep_remove() 

The current name is just confusing and doesn't clarify anything.

Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org


Signed-off-by: default avatarChristian Brauner (Amutable) <brauner@kernel.org>
parent 0feaf644

fs/eventpoll.c

+8 −8
Original line number Diff line number Diff line
@@ -882,7 +882,7 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) 
/*

 * ep_remove variant for callers owing an additional reference to the ep

 */

static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi)

static void ep_remove(struct eventpoll *ep, struct epitem *epi)

{

	struct file *file = epi->ffd.file;
@@ -929,7 +929,7 @@ static void ep_clear_and_put(struct eventpoll *ep) 


	/*

	 * Walks through the whole tree and try to free each "struct epitem".

	 * Note that ep_remove_safe() will not remove the epitem in case of a

	 * Note that ep_remove() will not remove the epitem in case of a

	 * racing eventpoll_release_file(); the latter will do the removal.

	 * At this point we are sure no poll callbacks will be lingering around.

	 * Since we still own a reference to the eventpoll struct, the loop can't
@@ -938,7 +938,7 @@ static void ep_clear_and_put(struct eventpoll *ep) 
	for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) {

		next = rb_next(rbp);

		epi = rb_entry(rbp, struct epitem, rbn);

		ep_remove_safe(ep, epi);

		ep_remove(ep, epi);

		cond_resched();

	}
@@ -1631,21 +1631,21 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, 
		mutex_unlock(&tep->mtx);



	/*

	 * ep_remove_safe() calls in the later error paths can't lead to

	 * ep_remove() calls in the later error paths can't lead to

	 * ep_free() as the ep file itself still holds an ep reference.

	 */

	ep_get(ep);



	/* now check if we've created too many backpaths */

	if (unlikely(full_check && reverse_path_check())) {

		ep_remove_safe(ep, epi);

		ep_remove(ep, epi);

		return -EINVAL;

	}



	if (epi->event.events & EPOLLWAKEUP) {

		error = ep_create_wakeup_source(epi);

		if (error) {

			ep_remove_safe(ep, epi);

			ep_remove(ep, epi);

			return error;

		}

	}
@@ -1669,7 +1669,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, 
	 * high memory pressure.

	 */

	if (unlikely(!epq.epi)) {

		ep_remove_safe(ep, epi);

		ep_remove(ep, epi);

		return -ENOMEM;

	}
@@ -2364,7 +2364,7 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, 
			 * The eventpoll itself is still alive: the refcount

			 * can't go to zero here.

			 */

			ep_remove_safe(ep, epi);

			ep_remove(ep, epi);

			error = 0;

		} else {

			error = -ENOENT;