Konstantin Khlebnikov ebe06187bf epoll: fix use-after-free in eventpoll_release_file ... This fixes use-after-free of epi->fllink.next inside list loop macro. This loop actually releases elements in the body. The list is rcu-protected but here we cannot hold rcu_read_lock because we need to lock mutex inside. The obvious solution is to use list_for_each_entry_safe(). RCU-ness isn't essential because nobody can change this list under us, it's final fput for this file. The bug was introduced by ae10b2b4eb ("epoll: optimize EPOLL_CTL_DEL using rcu") Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> Reported-by: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Stable <stable@vger.kernel.org> # 3.13+ Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Jason Baron <jbaron@akamai.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-06-16 17:21:59 -10:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
adfs	…
affs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
afs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
autofs4	…
befs	…
bfs	…
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-06-14 19:48:43 -05:00
cachefiles	…
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-06-12 23:06:23 -07:00
cifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
coda	…
configfs	…
cramfs	…
debugfs	…
devpts	…
dlm	dlm: keep listening connection alive with sctp mode	2014-06-12 10:26:14 -05:00
ecryptfs	…
efivarfs	…
efs	…
exofs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
exportfs	…
ext2	…
ext3	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ext4	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
f2fs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
fat	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
freevxfs	…
fscache	…
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
gfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hfs	…
hfsplus	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hostfs	…
hpfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hppfs	…
hugetlbfs	…
isofs	…
jbd	…
jbd2	…
jffs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
jfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
kernfs	…
lockd	…
logfs	…
minix	…
ncpfs	…
nfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
nfs_common	…
nfsd	…
nilfs2	…
nls	…
notify	…
ntfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ocfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
omfs	…
openpromfs	…
proc	…
pstore	…
qnx4	…
qnx6	…
quota	…
ramfs	…
reiserfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
romfs	…
squashfs	…
sysfs	…
sysv	…
ubifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
udf	…
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
xfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
Kconfig	…
Kconfig.binfmt	…
Makefile	…
aio.c	Merge git://git.kvack.org/~bcrl/aio-next	2014-06-14 19:43:27 -05:00
anon_inodes.c	…
attr.c	…
bad_inode.c	…
binfmt_aout.c	…
binfmt_elf.c	…
binfmt_elf_fdpic.c	…
binfmt_em86.c	…
binfmt_flat.c	…
binfmt_misc.c	…
binfmt_script.c	…
binfmt_som.c	…
block_dev.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
buffer.c	…
char_dev.c	…
compat.c	…
compat_binfmt_elf.c	…
compat_ioctl.c	…
coredump.c	…
dcache.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
dcookies.c	…
direct-io.c	…
drop_caches.c	…
eventfd.c	…
eventpoll.c	epoll: fix use-after-free in eventpoll_release_file	2014-06-16 17:21:59 -10:00
exec.c	…
fcntl.c	…
fhandle.c	…
file.c	…
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
filesystems.c	…
fs-writeback.c	…
fs_struct.c	…
inode.c	…
internal.h	…
ioctl.c	…
libfs.c	…
locks.c	…
mbcache.c	…
mount.h	…
mpage.c	…
namei.c	…
namespace.c	…
no-block.c	…
open.c	…
pipe.c	…
pnode.c	…
pnode.h	…
posix_acl.c	…
proc_namespace.c	…
read_write.c	…
readdir.c	…
select.c	…
seq_file.c	…
signalfd.c	…
splice.c	Merge commit '9f12600fe425bc28f0ccba034a77783c09c15af4' into for-linus	2014-06-12 00:28:09 -04:00
stack.c	…
stat.c	…
statfs.c	…
super.c	…
sync.c	…
timerfd.c	…
utimes.c	…
xattr.c	…