epoll: ep_unregister_pollwait() can use the freed pwq->whead
authorOleg Nesterov <oleg@redhat.com>
Fri, 24 Feb 2012 19:07:29 +0000 (20:07 +0100)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 24 Feb 2012 19:42:50 +0000 (11:42 -0800)
commit971316f0503a5c50633d07b83b6db2f15a3a5b00
treed833e48aed1b20d8677e9391250d8948966d6f4d
parentd80e731ecab420ddcb79ee9d0ac427acbc187b4b
epoll: ep_unregister_pollwait() can use the freed pwq->whead

signalfd_cleanup() ensures that ->signalfd_wqh is not used, but
this is not enough. eppoll_entry->whead still points to the memory
we are going to free, ep_unregister_pollwait()->remove_wait_queue()
is obviously unsafe.

Change ep_poll_callback(POLLFREE) to set eppoll_entry->whead = NULL,
change ep_unregister_pollwait() to check pwq->whead != NULL under
rcu_read_lock() before remove_wait_queue(). We add the new helper,
ep_remove_wait_queue(), for this.

This works because sighand_cachep is SLAB_DESTROY_BY_RCU and because
->signalfd_wqh is initialized in sighand_ctor(), not in copy_sighand.
ep_unregister_pollwait()->remove_wait_queue() can play with already
freed and potentially reused ->sighand, but this is fine. This memory
must have the valid ->signalfd_wqh until rcu_read_unlock().

Reported-by: Maxime Bizon <mbizon@freebox.fr>
Cc: <stable@kernel.org>
Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
fs/eventpoll.c
fs/signalfd.c