• Oleg Nesterov's avatar
    epoll: fix race between ep_poll_callback(POLLFREE) and ep_free()/ep_remove() · d325f1f1
    Oleg Nesterov authored
    commit 138e4ad6 upstream.
    
    The race was introduced by me in commit 971316f0 ("epoll:
    ep_unregister_pollwait() can use the freed pwq->whead").  I did not
    realize that nothing can protect eventpoll after ep_poll_callback() sets
    ->whead = NULL, only whead->lock can save us from the race with
    ep_free() or ep_remove().
    
    Move ->whead = NULL to the end of ep_poll_callback() and add the
    necessary barriers.
    
    TODO: cleanup the ewake/EPOLLEXCLUSIVE logic, it was confusing even
    before this patch.
    
    Hopefully this explains use-after-free reported by syzcaller:
    
    	BUG: KASAN: use-after-free in debug_spin_lock_before
    	...
    	 _raw_spin_lock_irqsave+0x4a/0x60 kernel/locking/spinlock.c:159
    	 ep_poll_callback+0x29f/0xff0 fs/eventpoll.c:1148
    
    this is spin_lock(eventpoll->lock),
    
    	...
    	Freed by task 17774:
    	...
    	 kfree+0xe8/0x2c0 mm/slub.c:3883
    	 ep_free+0x22c/0x2a0 fs/eventpoll.c:865
    
    Fixes: 971316f0 ("epoll: ep_unregister_pollwait() can use the freed pwq->whead")
    Reported-by: default avatar范龙飞 <long7573@126.com>
    Signed-off-by: default avatarOleg Nesterov <oleg@redhat.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    
    d325f1f1
eventpoll.c 60.5 KB