summaryrefslogtreecommitdiffstats
path: root/mm/migrate.c
diff options
context:
space:
mode:
authorDavide Libenzi <davidel@xmailserver.org>2011-02-25 14:44:12 -0800
committerLinus Torvalds <torvalds@linux-foundation.org>2011-02-25 15:07:36 -0800
commit22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e (patch)
tree7762c2923b3bded3f6c01f9fc509b4726401794f /mm/migrate.c
parent6366213ee3355278a90d1c20a1971c68fa3af68b (diff)
downloadop-kernel-dev-22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e.zip
op-kernel-dev-22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e.tar.gz
epoll: prevent creating circular epoll structures
In several places, an epoll fd can call another file's ->f_op->poll() method with ep->mtx held. This is in general unsafe, because that other file could itself be an epoll fd that contains the original epoll fd. The code defends against this possibility in its own ->poll() method using ep_call_nested, but there are several other unsafe calls to ->poll elsewhere that can be made to deadlock. For example, the following simple program causes the call in ep_insert recursively call the original fd's ->poll, leading to deadlock: #include <unistd.h> #include <sys/epoll.h> int main(void) { int e1, e2, p[2]; struct epoll_event evt = { .events = EPOLLIN }; e1 = epoll_create(1); e2 = epoll_create(2); pipe(p); epoll_ctl(e2, EPOLL_CTL_ADD, e1, &evt); epoll_ctl(e1, EPOLL_CTL_ADD, p[0], &evt); write(p[1], p, sizeof p); epoll_ctl(e1, EPOLL_CTL_ADD, e2, &evt); return 0; } On insertion, check whether the inserted file is itself a struct epoll, and if so, do a recursive walk to detect whether inserting this file would create a loop of epoll structures, which could lead to deadlock. [nelhage@ksplice.com: Use epmutex to serialize concurrent inserts] Signed-off-by: Davide Libenzi <davidel@xmailserver.org> Signed-off-by: Nelson Elhage <nelhage@ksplice.com> Reported-by: Nelson Elhage <nelhage@ksplice.com> Tested-by: Nelson Elhage <nelhage@ksplice.com> Cc: <stable@kernel.org> [2.6.34+, possibly earlier] Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'mm/migrate.c')
0 files changed, 0 insertions, 0 deletions
OpenPOWER on IntegriCloud