https://github.com/torvalds/linux
Revision 138e4ad67afd5c6c318b056b4d17c17f2c0ca5c0 authored by Oleg Nesterov on 01 September 2017, 16:55:33 UTC, committed by Linus Torvalds on 01 September 2017, 20:07:35 UTC
The race was introduced by me in commit 971316f0503a ("epoll:
ep_unregister_pollwait() can use the freed pwq->whead"). I did not
realize that nothing can protect eventpoll after ep_poll_callback() sets
->whead = NULL, only whead->lock can save us from the race with
ep_free() or ep_remove().
Move ->whead = NULL to the end of ep_poll_callback() and add the
necessary barriers.
TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
before this patch.
Hopefully this explains use-after-free reported by syzcaller:
BUG: KASAN: use-after-free in debug_spin_lock_before
...
_raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
this is spin_lock(eventpoll->lock),
...
Freed by task 17774:
...
kfree+0xe8/0x2c0 mm/slub.c:3883
ep_free+0x22c/0x2a0 fs/eventpoll.c:865
Fixes: 971316f0503a ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
Reported-by: 范龙飞 <long7573@126.com>
Cc: stable@vger.kernel.org
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 8cf9f2a
Tip revision: 138e4ad67afd5c6c318b056b4d17c17f2c0ca5c0 authored by Oleg Nesterov on 01 September 2017, 16:55:33 UTC
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove()
Tip revision: 138e4ad
| File | Mode | Size |
|---|---|---|
| Documentation | ||
| arch | ||
| block | ||
| certs | ||
| crypto | ||
| drivers | ||
| firmware | ||
| fs | ||
| include | ||
| init | ||
| ipc | ||
| kernel | ||
| lib | ||
| mm | ||
| net | ||
| samples | ||
| scripts | ||
| security | ||
| sound | ||
| tools | ||
| usr | ||
| virt | ||
| .cocciconfig | -rw-r--r-- | 59 bytes |
| .get_maintainer.ignore | -rw-r--r-- | 31 bytes |
| .gitattributes | -rw-r--r-- | 30 bytes |
| .gitignore | -rw-r--r-- | 1.3 KB |
| .mailmap | -rw-r--r-- | 8.1 KB |
| COPYING | -rw-r--r-- | 18.3 KB |
| CREDITS | -rw-r--r-- | 96.2 KB |
| Kbuild | -rw-r--r-- | 2.2 KB |
| Kconfig | -rw-r--r-- | 252 bytes |
| MAINTAINERS | -rw-r--r-- | 411.0 KB |
| Makefile | -rw-r--r-- | 58.8 KB |
| README | -rw-r--r-- | 722 bytes |
Computing file changes ...
