From 52c479697c9b73f628140dcdfcd39ea302d05482 Mon Sep 17 00:00:00 2001
From: Al Viro <viro@zeniv.linux.org.uk>
Date: Sat Aug 22 18:25:52 2020 -0400
Subject: [PATCH] do_epoll_ctl(): clean the failure exits up a bit
Git-commit: 52c479697c9b73f628140dcdfcd39ea302d05482
References: bsc#1180031,CVE-2020-0466
Patch-mainline: v5.9-rc2
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Acked-by: Goldwyn Rodrigues <rgoldwyn@suse.com>
---
fs/eventpoll.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -2182,10 +2182,8 @@
mutex_lock(&epmutex);
if (is_file_epoll(tf.file)) {
error = -ELOOP;
- if (ep_loop_check(ep, tf.file) != 0) {
- clear_tfile_check_list();
+ if (ep_loop_check(ep, tf.file) != 0)
goto error_tgt_fput;
- }
} else {
get_file(tf.file);
list_add(&tf.file->f_tfile_llink,
@@ -2214,8 +2212,6 @@
error = ep_insert(ep, &epds, tf.file, fd, full_check);
} else
error = -EEXIST;
- if (full_check)
- clear_tfile_check_list();
break;
case EPOLL_CTL_DEL:
if (epi)
@@ -2238,8 +2234,10 @@
mutex_unlock(&ep->mtx);
error_tgt_fput:
- if (full_check)
+ if (full_check) {
+ clear_tfile_check_list();
mutex_unlock(&epmutex);
+ }
fdput(tf);
error_fput: