From 2b10b54cde3267e7fabcda7a53d6cbfacdae4456 Mon Sep 17 00:00:00 2001 From: Al Viro Date: Thu, 15 Oct 2020 15:25:26 +0800 Subject: [PATCH] fix regression in "epoll: Keep a reference on files added to the check list" stable inclusion from linux-4.19.144 commit 37d933e8b41b83bb8278815e366aec5a542b7e31 CVE: CVE-2020-0466 -------------------------------- [ Upstream commit 77f4689de17c0887775bb77896f4cc11a39bf848 ] epoll_loop_check_proc() can run into a file already committed to destruction; we can't grab a reference on those and don't need to add them to the set for reverse path check anyway. Tested-by: Marc Zyngier Fixes: a9ed4a6560b8 ("epoll: Keep a reference on files added to the check list") Signed-off-by: Al Viro Signed-off-by: Sasha Levin Signed-off-by: Yang Yingliang --- fs/eventpoll.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 6387b6128f3e..76f9079a6802 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -1893,9 +1893,9 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) * during ep_insert(). */ if (list_empty(&epi->ffd.file->f_tfile_llink)) { - get_file(epi->ffd.file); - list_add(&epi->ffd.file->f_tfile_llink, - &tfile_check_list); + if (get_file_rcu(epi->ffd.file)) + list_add(&epi->ffd.file->f_tfile_llink, + &tfile_check_list); } } } -- GitLab