Konstantin Khlebnikov ebe06187bf epoll: fix use-after-free in eventpoll_release_file ... This fixes use-after-free of epi->fllink.next inside list loop macro. This loop actually releases elements in the body. The list is rcu-protected but here we cannot hold rcu_read_lock because we need to lock mutex inside. The obvious solution is to use list_for_each_entry_safe(). RCU-ness isn't essential because nobody can change this list under us, it's final fput for this file. The bug was introduced by ae10b2b4eb ("epoll: optimize EPOLL_CTL_DEL using rcu") Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> Reported-by: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Stable <stable@vger.kernel.org> # 3.13+ Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Jason Baron <jbaron@akamai.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-06-16 17:21:59 -10:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
adfs	…
affs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
afs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
autofs4	fs/autofs4/dev-ioctl.c: add __init to autofs_dev_ioctl_init	2014-06-04 16:54:21 -07:00
befs	fs/befs: kernel-doc fixes	2014-06-06 16:08:09 -07:00
bfs	…
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-06-14 19:48:43 -05:00
cachefiles	fs/cachefiles: replace kerror by pr_err	2014-06-06 16:08:14 -07:00
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-06-12 23:06:23 -07:00
cifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
coda	coda: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
configfs	fs/configfs: use pr_fmt	2014-06-04 16:53:53 -07:00
cramfs	…
debugfs	…
devpts	fs/devpts/inode.c: convert printk to pr_foo()	2014-06-06 16:08:14 -07:00
dlm	dlm: keep listening connection alive with sctp mode	2014-06-12 10:26:14 -05:00
ecryptfs	…
efivarfs	fs/efivarfs/super.c: use static const for dentry_operations	2014-06-04 16:54:14 -07:00
efs	fs/efs: convert printk(KERN_DEBUG to pr_debug	2014-06-04 16:54:21 -07:00
exofs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
exportfs	fs/exportfs/expfs.c: kernel-doc warning fixes	2014-06-04 16:54:14 -07:00
ext2	->splice_write() via ->write_iter()	2014-06-12 00:18:51 -04:00
ext3	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ext4	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
f2fs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
fat	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
freevxfs	…
fscache	fscache: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
gfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hfs	…
hfsplus	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hostfs	…
hpfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hppfs	…
hugetlbfs	fs/hugetlbfs/inode.c: remove null test before kfree	2014-06-04 16:54:11 -07:00
isofs	…
jbd	…
jbd2	…
jffs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
jfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
kernfs	kernfs: move the last knowledge of sysfs out from kernfs	2014-06-03 08:11:18 -07:00
lockd	Merge branch 'for-3.16' of git://linux-nfs.org/~bfields/linux	2014-06-10 11:50:57 -07:00
logfs	…
minix	…
ncpfs	fs/ncpfs/getopt.c: replace simple_strtoul by kstrtoul	2014-06-04 16:54:21 -07:00
nfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
nfs_common	…
nfsd	nfsd4: fix FREE_STATEID lockowner leak	2014-06-09 17:13:54 -04:00
nilfs2	…
nls	…
notify	inotify: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
ntfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ocfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
omfs	…
openpromfs	…
proc	Merge branch 'next' (accumulated 3.16 merge window patches) into master	2014-06-08 11:31:16 -07:00
pstore	fs/pstore: logging clean-up	2014-06-06 16:08:13 -07:00
qnx4	…
qnx6	…
quota	…
ramfs	->splice_write() via ->write_iter()	2014-06-12 00:18:51 -04:00
reiserfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
romfs	…
squashfs	fs/squashfs/squashfs.h: replace pr_warning by pr_warn	2014-06-04 16:53:52 -07:00
sysfs	kernfs: move the last knowledge of sysfs out from kernfs	2014-06-03 08:11:18 -07:00
sysv	…
ubifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
udf	…
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
xfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
Kconfig	…
Kconfig.binfmt	…
Makefile	…
aio.c	Merge git://git.kvack.org/~bcrl/aio-next	2014-06-14 19:43:27 -05:00
anon_inodes.c	…
attr.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
bad_inode.c	…
binfmt_aout.c	…
binfmt_elf.c	Merge branch 'x86/vdso' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip into next	2014-06-05 08:05:29 -07:00
binfmt_elf_fdpic.c	…
binfmt_em86.c	…
binfmt_flat.c	fs/binfmt_flat.c: make old_reloc() static	2014-06-04 16:54:21 -07:00
binfmt_misc.c	…
binfmt_script.c	…
binfmt_som.c	…
block_dev.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
buffer.c	mm: non-atomically mark page accessed during page cache allocation where possible	2014-06-04 16:54:10 -07:00
char_dev.c	…
compat.c	…
compat_binfmt_elf.c	…
compat_ioctl.c	…
coredump.c	…
dcache.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
dcookies.c	…
direct-io.c	…
drop_caches.c	fs: convert use of typedef ctl_table to struct ctl_table	2014-06-06 16:08:16 -07:00
eventfd.c	…
eventpoll.c	epoll: fix use-after-free in eventpoll_release_file	2014-06-16 17:21:59 -10:00
exec.c	perf: Differentiate exec() and non-exec() comm events	2014-06-06 07:56:22 +02:00
fcntl.c	…
fhandle.c	…
file.c	…
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
filesystems.c	…
fs-writeback.c	…
fs_struct.c	…
inode.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
internal.h	…
ioctl.c	…
libfs.c	fs/libfs.c: add generic data flush to fsync	2014-06-04 16:53:55 -07:00
locks.c	locks: add some tracepoints in the lease handling code	2014-06-02 08:09:30 -04:00
mbcache.c	…
mount.h	…
mpage.c	fs/block_dev.c: add bdev_read_page() and bdev_write_page()	2014-06-04 16:54:02 -07:00
namei.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
namespace.c	…
no-block.c	…
open.c	…
pipe.c	…
pnode.c	…
pnode.h	…
posix_acl.c	…
proc_namespace.c	…
read_write.c	…
readdir.c	fanotify: create FAN_ACCESS event for readdir	2014-06-04 16:53:52 -07:00
select.c	…
seq_file.c	…
signalfd.c	…
splice.c	Merge commit '9f12600fe425bc28f0ccba034a77783c09c15af4' into for-linus	2014-06-12 00:28:09 -04:00
stack.c	…
stat.c	…
statfs.c	…
super.c	fs/superblock: avoid locking counting inodes and dentries before reclaiming them	2014-06-04 16:54:11 -07:00
sync.c	…
timerfd.c	…
utimes.c	…
xattr.c	…