Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
eventpoll: rename ep_remove_safe() back to ep_remove()
The current name is just confusing and doesn't clarify anything.
Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
+8
-8
+8
-8
fs/eventpoll.c
+8
-8
fs/eventpoll.c
···
882
882
/*
883
883
* ep_remove variant for callers owing an additional reference to the ep
884
884
*/
885
-
static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi)
885
+
static void ep_remove(struct eventpoll *ep, struct epitem *epi)
886
886
{
887
887
struct file *file = epi->ffd.file;
888
888
···
929
929
930
930
/*
931
931
* Walks through the whole tree and try to free each "struct epitem".
932
-
* Note that ep_remove_safe() will not remove the epitem in case of a
932
+
* Note that ep_remove() will not remove the epitem in case of a
933
933
* racing eventpoll_release_file(); the latter will do the removal.
934
934
* At this point we are sure no poll callbacks will be lingering around.
935
935
* Since we still own a reference to the eventpoll struct, the loop can't
···
938
938
for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) {
939
939
next = rb_next(rbp);
940
940
epi = rb_entry(rbp, struct epitem, rbn);
941
-
ep_remove_safe(ep, epi);
941
+
ep_remove(ep, epi);
942
942
cond_resched();
943
943
}
944
944
···
1631
1631
mutex_unlock(&tep->mtx);
1632
1632
1633
1633
/*
1634
-
* ep_remove_safe() calls in the later error paths can't lead to
1634
+
* ep_remove() calls in the later error paths can't lead to
1635
1635
* ep_free() as the ep file itself still holds an ep reference.
1636
1636
*/
1637
1637
ep_get(ep);
1638
1638
1639
1639
/* now check if we've created too many backpaths */
1640
1640
if (unlikely(full_check && reverse_path_check())) {
1641
-
ep_remove_safe(ep, epi);
1641
+
ep_remove(ep, epi);
1642
1642
return -EINVAL;
1643
1643
}
1644
1644
1645
1645
if (epi->event.events & EPOLLWAKEUP) {
1646
1646
error = ep_create_wakeup_source(epi);
1647
1647
if (error) {
1648
-
ep_remove_safe(ep, epi);
1648
+
ep_remove(ep, epi);
1649
1649
return error;
1650
1650
}
1651
1651
}
···
1669
1669
* high memory pressure.
1670
1670
*/
1671
1671
if (unlikely(!epq.epi)) {
1672
-
ep_remove_safe(ep, epi);
1672
+
ep_remove(ep, epi);
1673
1673
return -ENOMEM;
1674
1674
}
1675
1675
···
2364
2364
* The eventpoll itself is still alive: the refcount
2365
2365
* can't go to zero here.
2366
2366
*/
2367
-
ep_remove_safe(ep, epi);
2367
+
ep_remove(ep, epi);
2368
2368
error = 0;
2369
2369
} else {
2370
2370
error = -ENOENT;