Commit 2328d92a authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] Fix race in epoll_ctl(EPOLL_CTL_MOD)

From: Davide Libenzi <davidel@xmailserver.org>

A potential race can happen in epoll_ctl(EPOLL_CTL_MOD) where an event can
happen in between f_op->poll() and the lock on ep->lock (we cannot call
f_op->poll() inside a lock, and the f_op->poll() callback does not carry
any info at the current time - missing wake_up_info() already ;).  In that
case the event would be removed.  We can easily leave the event inside the
ready list and have the ep_send_events() logic do the job for us at later
time.  (Thanks to david.lee@teracruz.com for reporting the thing, since it
shouldn't have been a nice one ;)
parent 2268bb30
......@@ -1155,8 +1155,7 @@ static int ep_modify(struct eventpoll *ep, struct epitem *epi, struct epoll_even
if (waitqueue_active(&ep->poll_wait))
pwake++;
}
} else if (EP_IS_LINKED(&epi->rdllink))
EP_LIST_DEL(&epi->rdllink);
}
}
write_unlock_irqrestore(&ep->lock, flags);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment