Reviewed: https://review.opendev.org/672625 Committed: https://git.openstack.org/cgit/starlingx/integ/commit/?id=853388e615b6fb4fbec7fded3eb2652fe0120527 Submitter: Zuul Branch: master
commit 853388e615b6fb4fbec7fded3eb2652fe0120527 Author: Bin Yang <email address hidden> Date: Wed Jul 31 14:12:05 2019 +0800
epoll: fix use-after-free in eventpoll_release_file
back port upstream patch https://github.com/torvalds/linux/commit/ebe06187bf2aec10d537ce4595e416035367d703
the epi is removed from list by list_del_rcu(&epi->fllink); under list_for_each_entry_rcu() without rcu_read_lock.
if the rcu grace-period thread free epi before next list_for_each loop, the content of epi will be corrupted.
Change-Id: I75dbf8ada5ca4734761efe260ca6d6f85886b180 Closes-Bug: 1837430 Suggested-by: <email address hidden> Signed-off-by: Bin Yang <email address hidden>
Reviewed: https:/ /review. opendev. org/672625 /git.openstack. org/cgit/ starlingx/ integ/commit/ ?id=853388e615b 6fb4fbec7fded3e b2652fe0120527
Committed: https:/
Submitter: Zuul
Branch: master
commit 853388e615b6fb4 fbec7fded3eb265 2fe0120527
Author: Bin Yang <email address hidden>
Date: Wed Jul 31 14:12:05 2019 +0800
epoll: fix use-after-free in eventpoll_ release_ file
back port upstream patch /github. com/torvalds/ linux/commit/ ebe06187bf2aec1 0d537ce4595e416 035367d703
https:/
the epi is removed from list by list_del_ rcu(&epi- >fllink) ; each_entry_ rcu() without rcu_read_lock.
under list_for_
if the rcu grace-period thread free epi before next list_for_each loop,
the content of epi will be corrupted.
Change-Id: I75dbf8ada5ca47 34761efe260ca6d 6f85886b180
Closes-Bug: 1837430
Suggested-by: <email address hidden>
Signed-off-by: Bin Yang <email address hidden>