]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
projects / thirdparty / kernel / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 1635c2a) | patch
eventpoll: defer struct eventpoll free to RCU grace period
authorNicholas Carlini <nicholas@carlini.com>
Tue, 31 Mar 2026 13:25:32 +0000 (15:25 +0200)
committerChristian Brauner <brauner@kernel.org>
Thu, 2 Apr 2026 19:45:02 +0000 (21:45 +0200)
commit07712db80857d5d09ae08f3df85a708ecfc3b61f
treecab0b83e2c0ad5193da1fc9faf41a33591134774tree | snapshot
parent1635c2acdde86c4f555b627aec873c8677c421edcommit | diff
eventpoll: defer struct eventpoll free to RCU grace period

In certain situations, ep_free() in eventpoll.c will kfree the epi->ep
eventpoll struct while it still being used by another concurrent thread.
Defer the kfree() to an RCU callback to prevent UAF.

Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion")
Signed-off-by: Nicholas Carlini <nicholas@carlini.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
fs/eventpoll.c diff | blob | blame | history
A mirror of Linus' kernel repository