superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

eventpoll: refresh eventpoll_release() fast-path comment 

The old comment justified the lockless READ_ONCE(file->f_ep) check
with "False positives simply cannot happen because the file is on
the way to be removed and nobody ( but eventpoll ) has still a
reference to this file." That reasoning was the root of the UAF
fixed in "eventpoll: fix ep_remove struct eventpoll / struct file
UAF": __ep_remove() could clear f_ep while another close raced
past the fast path and freed the watched eventpoll / recycled the
struct file slot.

With ep_remove() now pinning @file via epi_fget() across the f_ep
clear and hlist_del_rcu(), the invariant is re-established for the
right reason: anyone who might clear f_ep holds @file alive for
the duration, so a NULL observation really does mean no
concurrent eventpoll path has work left on this file. Refresh the
comment accordingly so the next reader doesn't inherit the broken
model.

Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
master
Christian Brauner 2026-04-23 11:56:11 +02:00
parent d30deeb8b0
commit 33e92e9ecf
No known key found for this signature in database
GPG Key ID: 91C61BC06578DCA2
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
include/linux/eventpoll.h
View File

@ -39,12 +39,16 @@ static inline void eventpoll_release(struct file *file)
{
/*
* Fast check to avoid the get/release of the semaphore. Since
* we're doing this outside the semaphore lock, it might return
* false negatives, but we don't care. It'll help in 99.99% of cases
* to avoid the semaphore lock. False positives simply cannot happen
* because the file in on the way to be removed and nobody ( but
* eventpoll ) has still a reference to this file.
* Fast check to skip the slow path in the common case where the
* file was never attached to an epoll. Safe without file->f_lock
* because every f_ep writer excludes a concurrent __fput() on
* @file:
* - ep_insert() requires the file alive (refcount > 0);
* - ep_remove() holds @file pinned via epi_fget() across the
* write;
* - eventpoll_release_file() runs from __fput() itself.
* We are in __fput() here, so none of those can race us: a NULL
* observation truly means no epoll path has work left on @file.
*/
if (likely(!READ_ONCE(file->f_ep)))
return;