From: Cyrill Gorcunov <gorcunov@gmail.com>
To: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Andrew Morton <akpm@linux-foundation.org>,
linux-kernel@vger.kernel.org,
Sasha Levin <sasha.levin@oracle.com>,
Jason Baron <jbaron@akamai.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Stable <stable@vger.kernel.org>
Subject: Re: [PATCH] epoll: fix use-after-free in eventpoll_release_file
Date: Tue, 17 Jun 2014 09:50:42 +0400 [thread overview]
Message-ID: <20140617055042.GA3064@moon> (raw)
In-Reply-To: <20140617025805.29539.22007.stgit@zurg>
On Tue, Jun 17, 2014 at 06:58:05AM +0400, Konstantin Khlebnikov wrote:
> This fixes use-after-free of epi->fllink.next inside list loop macro.
> This loop actually releases elements in the body. List is rcu-protected
> but here we cannot hold rcu_read_lock because we need to lock mutex inside.
>
> Obvious solution is to use list_for_each_entry_safe(). RCU-ness isn't essential
> because nobody can change this list under us, it's final fput for this file.
>
> Bug is here since ae10b2b4eb01bedc91d29d5c5bb9e416fd806c40
> ("epoll: optimize EPOLL_CTL_DEL using rcu")
>
> Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com>
> Reported-by: Cyrill Gorcunov <gorcunov@openvz.org>
> Cc: Stable <stable@vger.kernel.org> # 3.13+
> Cc: Sasha Levin <sasha.levin@oracle.com>
> Cc: Jason Baron <jbaron@akamai.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
next prev parent reply other threads:[~2014-06-17 5:50 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-06-17 2:58 [PATCH] epoll: fix use-after-free in eventpoll_release_file Konstantin Khlebnikov
2014-06-17 3:02 ` Konstantin Khlebnikov
2014-06-17 5:50 ` Cyrill Gorcunov [this message]
2014-06-17 16:40 ` Jason Baron
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20140617055042.GA3064@moon \
--to=gorcunov@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=jbaron@akamai.com \
--cc=koct9i@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=sasha.levin@oracle.com \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.