Konstantin Khlebnikov ebe06187bf epoll: fix use-after-free in eventpoll_release_file ... This fixes use-after-free of epi->fllink.next inside list loop macro. This loop actually releases elements in the body. The list is rcu-protected but here we cannot hold rcu_read_lock because we need to lock mutex inside. The obvious solution is to use list_for_each_entry_safe(). RCU-ness isn't essential because nobody can change this list under us, it's final fput for this file. The bug was introduced by ae10b2b4eb ("epoll: optimize EPOLL_CTL_DEL using rcu") Signed-off-by: Konstantin Khlebnikov <koct9i@gmail.com> Reported-by: Cyrill Gorcunov <gorcunov@openvz.org> Cc: Stable <stable@vger.kernel.org> # 3.13+ Cc: Sasha Levin <sasha.levin@oracle.com> Cc: Jason Baron <jbaron@akamai.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2014-06-16 17:21:59 -10:00
..
9p	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
adfs
affs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
afs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
autofs4
befs
bfs
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2014-06-14 19:48:43 -05:00
cachefiles
ceph	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client	2014-06-12 23:06:23 -07:00
cifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
coda
configfs
cramfs
debugfs
devpts
dlm	dlm: keep listening connection alive with sctp mode	2014-06-12 10:26:14 -05:00
ecryptfs
efivarfs
efs
exofs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
exportfs
ext2	->splice_write() via ->write_iter()	2014-06-12 00:18:51 -04:00
ext3	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ext4	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
f2fs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
fat	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
freevxfs
fscache
fuse	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
gfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hfs
hfsplus	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hostfs
hpfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
hppfs
hugetlbfs
isofs
jbd
jbd2
jffs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
jfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
kernfs
lockd	Merge branch 'for-3.16' of git://linux-nfs.org/~bfields/linux	2014-06-10 11:50:57 -07:00
logfs
minix
ncpfs
nfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
nfs_common
nfsd
nilfs2
nls
notify
ntfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
ocfs2	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
omfs
openpromfs
proc
pstore
qnx4
qnx6
quota
ramfs	->splice_write() via ->write_iter()	2014-06-12 00:18:51 -04:00
reiserfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
romfs
squashfs
sysfs
sysv
ubifs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
udf
ufs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
xfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
aio.c	Merge git://git.kvack.org/~bcrl/aio-next	2014-06-14 19:43:27 -05:00
anon_inodes.c
attr.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
bad_inode.c
binfmt_aout.c
binfmt_elf_fdpic.c
binfmt_elf.c
binfmt_em86.c
binfmt_flat.c
binfmt_misc.c
binfmt_script.c
binfmt_som.c
block_dev.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
buffer.c
char_dev.c
compat_binfmt_elf.c
compat_ioctl.c
compat.c
coredump.c
dcache.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
dcookies.c
direct-io.c
drop_caches.c
eventfd.c
eventpoll.c	epoll: fix use-after-free in eventpoll_release_file	2014-06-16 17:21:59 -10:00
exec.c
fcntl.c
fhandle.c
file_table.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2014-06-12 10:30:18 -07:00
file.c
filesystems.c
fs_struct.c
fs-writeback.c
inode.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
internal.h
ioctl.c
Kconfig
Kconfig.binfmt
libfs.c
locks.c
Makefile
mbcache.c
mount.h
mpage.c
namei.c	fs,userns: Change inode_capable to capable_wrt_inode_uidgid	2014-06-10 13:57:22 -07:00
namespace.c
no-block.c
open.c
pipe.c
pnode.c
pnode.h
posix_acl.c
proc_namespace.c
read_write.c
readdir.c
select.c
seq_file.c
signalfd.c
splice.c	Merge commit '9f12600fe425bc28f0ccba034a77783c09c15af4' into for-linus	2014-06-12 00:28:09 -04:00
stack.c
stat.c
statfs.c
super.c
sync.c
timerfd.c
utimes.c
xattr.c