Skip to main content

Browse the archive

https://github.com/torvalds/linux
27 March 2024, 02:37:15 UTC
Revision 971316f0503a5c50633d07b83b6db2f15a3a5b00 authored by Oleg Nesterov on 24 February 2012, 19:07:29 UTC, committed by Linus Torvalds on 24 February 2012, 19:42:50 UTC 
epoll: ep_unregister_pollwait() can use the freed pwq->whead
 
signalfd_cleanup() ensures that ->signalfd_wqh is not used, but
this is not enough. eppoll_entry->whead still points to the memory
we are going to free, ep_unregister_pollwait()->remove_wait_queue()
is obviously unsafe.

Change ep_poll_callback(POLLFREE) to set eppoll_entry->whead = NULL,
change ep_unregister_pollwait() to check pwq->whead != NULL under
rcu_read_lock() before remove_wait_queue(). We add the new helper,
ep_remove_wait_queue(), for this.

This works because sighand_cachep is SLAB_DESTROY_BY_RCU and because
->signalfd_wqh is initialized in sighand_ctor(), not in copy_sighand.
ep_unregister_pollwait()->remove_wait_queue() can play with already
freed and potentially reused ->sighand, but this is fine. This memory
must have the valid ->signalfd_wqh until rcu_read_unlock().

Reported-by: Maxime Bizon <mbizon@freebox.fr>
Cc: <stable@kernel.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent d80e731
History
Tip revision: 971316f0503a5c50633d07b83b6db2f15a3a5b00 authored by Oleg Nesterov on 24 February 2012, 19:07:29 UTC
epoll: ep_unregister_pollwait() can use the freed pwq->whead
Tip revision: 971316f
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 1014 bytes
.mailmap -rw-r--r-- 4.2 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 92.8 KB
Kbuild -rw-r--r-- 2.5 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 202.1 KB
Makefile -rw-r--r-- 52.2 KB
README -rw-r--r-- 17.0 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top