eventpoll: rename ep_remove_safe() back to ep_remove()

The current name is just confusing and doesn't clarify anything.

Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index c9940d50c3fe8d222ef1231cece72cf50f19b083..f9b601f5c0ad9d4693f88600db83edcea64f567e 100644 (file)
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -882,7 +882,7 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi)
 /*
  * ep_remove variant for callers owing an additional reference to the ep
  */
-static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi)
+static void ep_remove(struct eventpoll *ep, struct epitem *epi)
 {
        struct file *file = epi->ffd.file;
 
@@ -929,7 +929,7 @@ static void ep_clear_and_put(struct eventpoll *ep)
 
        /*
         * Walks through the whole tree and try to free each "struct epitem".
-        * Note that ep_remove_safe() will not remove the epitem in case of a
+        * Note that ep_remove() will not remove the epitem in case of a
         * racing eventpoll_release_file(); the latter will do the removal.
         * At this point we are sure no poll callbacks will be lingering around.
         * Since we still own a reference to the eventpoll struct, the loop can't
@@ -938,7 +938,7 @@ static void ep_clear_and_put(struct eventpoll *ep)
        for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) {
                next = rb_next(rbp);
                epi = rb_entry(rbp, struct epitem, rbn);
-               ep_remove_safe(ep, epi);
+               ep_remove(ep, epi);
                cond_resched();
        }
 
@@ -1631,21 +1631,21 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
                mutex_unlock(&tep->mtx);
 
        /*
-        * ep_remove_safe() calls in the later error paths can't lead to
+        * ep_remove() calls in the later error paths can't lead to
         * ep_free() as the ep file itself still holds an ep reference.
         */
        ep_get(ep);
 
        /* now check if we've created too many backpaths */
        if (unlikely(full_check && reverse_path_check())) {
-               ep_remove_safe(ep, epi);
+               ep_remove(ep, epi);
                return -EINVAL;
        }
 
        if (epi->event.events & EPOLLWAKEUP) {
                error = ep_create_wakeup_source(epi);
                if (error) {
-                       ep_remove_safe(ep, epi);
+                       ep_remove(ep, epi);
                        return error;
                }
        }
@@ -1669,7 +1669,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event,
         * high memory pressure.
         */
        if (unlikely(!epq.epi)) {
-               ep_remove_safe(ep, epi);
+               ep_remove(ep, epi);
                return -ENOMEM;
        }
 
@@ -2364,7 +2364,7 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds,
                         * The eventpoll itself is still alive: the refcount
                         * can't go to zero here.
                         */
-                       ep_remove_safe(ep, epi);
+                       ep_remove(ep, epi);
                        error = 0;
                } else {
                        error = -ENOENT;