Unverified Commit 0f7bdfd4 authored by Christian Brauner's avatar Christian Brauner
Browse files

eventpoll: split __ep_remove() 



Split __ep_remove() to delineate file removal from epoll item removal.

Suggested-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org


Signed-off-by: default avatarChristian Brauner (Amutable) <brauner@kernel.org>
parent 3d9fd0ab

fs/eventpoll.c

+23 −4
Original line number Diff line number Diff line
@@ -826,6 +826,9 @@ static void ep_free(struct eventpoll *ep) 
	kfree_rcu(ep, rcu);

}



static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file);

static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi);



/*

 * Removes a "struct epitem" from the eventpoll RB tree and deallocates

 * all the associated resources. Must be called with "mtx" held.
@@ -837,8 +840,6 @@ static void ep_free(struct eventpoll *ep) 
static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force)

{

	struct file *file = epi->ffd.file;

	struct epitems_head *to_free;

	struct hlist_head *head;



	lockdep_assert_irqs_enabled();
@@ -854,8 +855,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) 
		return false;

	}



	to_free = NULL;

	head = file->f_ep;

	__ep_remove_file(ep, epi, file);

	return __ep_remove_epi(ep, epi);

}



/*

 * Called with &file->f_lock held,

 * returns with it released

 */

static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file)

{

	struct epitems_head *to_free = NULL;

	struct hlist_head *head = file->f_ep;



	lockdep_assert_held(&ep->mtx);



	if (hlist_is_singular_node(&epi->fllink, head)) {

		/* See eventpoll_release() for details. */

		WRITE_ONCE(file->f_ep, NULL);
@@ -869,6 +883,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) 
	hlist_del_rcu(&epi->fllink);

	spin_unlock(&file->f_lock);

	free_ephead(to_free);

}



static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi)

{

	lockdep_assert_held(&ep->mtx);



	rb_erase_cached(&epi->rbn, &ep->rbr);