Commit f320ac6e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 

Pull epoll fixes from Al Viro:
 "Fix reference counting and clean up exit paths"

* 'work.epoll' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  do_epoll_ctl(): clean the failure exits up a bit
  epoll: Keep a reference on files added to the check list
parents c3d8f220 52c47969

fs/eventpoll.c

+13 −13
Original line number Diff line number Diff line
@@ -1994,11 +1994,13 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests) 
			 * not already there, and calling reverse_path_check()

			 * during ep_insert().

			 */

			if (list_empty(&epi->ffd.file->f_tfile_llink))

			if (list_empty(&epi->ffd.file->f_tfile_llink)) {

				get_file(epi->ffd.file);

				list_add(&epi->ffd.file->f_tfile_llink,

					 &tfile_check_list);

			}

		}

	}

	mutex_unlock(&ep->mtx);



	return error;
@@ -2040,6 +2042,7 @@ static void clear_tfile_check_list(void) 
		file = list_first_entry(&tfile_check_list, struct file,

					f_tfile_llink);

		list_del_init(&file->f_tfile_llink);

		fput(file);

	}

	INIT_LIST_HEAD(&tfile_check_list);

}
@@ -2200,25 +2203,22 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, 
			full_check = 1;

			if (is_file_epoll(tf.file)) {

				error = -ELOOP;

				if (ep_loop_check(ep, tf.file) != 0) {

					clear_tfile_check_list();

				if (ep_loop_check(ep, tf.file) != 0)

					goto error_tgt_fput;

				}

			} else

			} else {

				get_file(tf.file);

				list_add(&tf.file->f_tfile_llink,

							&tfile_check_list);

			}

			error = epoll_mutex_lock(&ep->mtx, 0, nonblock);

			if (error) {

out_del:

				list_del(&tf.file->f_tfile_llink);

			if (error)

				goto error_tgt_fput;

			}

			if (is_file_epoll(tf.file)) {

				tep = tf.file->private_data;

				error = epoll_mutex_lock(&tep->mtx, 1, nonblock);

				if (error) {

					mutex_unlock(&ep->mtx);

					goto out_del;

					goto error_tgt_fput;

				}

			}

		}
@@ -2239,8 +2239,6 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, 
			error = ep_insert(ep, epds, tf.file, fd, full_check);

		} else

			error = -EEXIST;

		if (full_check)

			clear_tfile_check_list();

		break;

	case EPOLL_CTL_DEL:

		if (epi)
@@ -2263,8 +2261,10 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, 
	mutex_unlock(&ep->mtx);



error_tgt_fput:

	if (full_check)

	if (full_check) {

		clear_tfile_check_list();

		mutex_unlock(&epmutex);

	}



	fdput(tf);

error_fput: