| commit | 98022748f6c7bce85b9f123fd4d1a621219dd8d9 | [log] [tgz] |
|---|---|---|
| author | Al Viro <viro@zeniv.linux.org.uk> | Fri Aug 17 22:42:36 2012 -0400 |
| committer | Al Viro <viro@zeniv.linux.org.uk> | Wed Aug 22 10:26:55 2012 -0400 |
| tree | 475003205a40e79060c072bf4ed6a2cf097ff7ed | |
| parent | 31605debdf5459cc8aacabf192a911a803a81c26 [diff] |
eventpoll: use-after-possible-free in epoll_create1() As soon as we'd installed the file into descriptor table, it can get closed by another thread. Freeing ep in process... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 1c8b556..eedec84 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c
@@ -1654,8 +1654,8 @@ error = PTR_ERR(file); goto out_free_fd; } - fd_install(fd, file); ep->file = file; + fd_install(fd, file); return fd; out_free_fd: