diff options
| author | Siddh Raman Pant <code@siddh.me> | 2023-06-05 17:36:16 +0300 |
|---|---|---|
| committer | Christian Brauner <brauner@kernel.org> | 2023-06-06 11:47:04 +0300 |
| commit | 943211c87427f25bd22e0e63849fb486bb5f87fa (patch) | |
| tree | c52147cc09a9a48ec908488f25575fed99c90ff2 /include/linux/watch_queue.h | |
| parent | a7bc2e8ddf3c8e1f5bfeb401f7ee112956cea259 (diff) | |
| download | linux-943211c87427f25bd22e0e63849fb486bb5f87fa.tar.xz | |
watch_queue: prevent dangling pipe pointer
NULL the dangling pipe reference while clearing watch_queue.
If not done, a reference to a freed pipe remains in the watch_queue,
as this function is called before freeing a pipe in free_pipe_info()
(see line 834 of fs/pipe.c).
The sole use of wqueue->defunct is for checking if the watch queue has
been cleared, but wqueue->pipe is also NULLed while clearing.
Thus, wqueue->defunct is superfluous, as wqueue->pipe can be checked
for NULL. Hence, the former can be removed.
Tested with keyutils testsuite.
Cc: stable@vger.kernel.org # 6.1
Signed-off-by: Siddh Raman Pant <code@siddh.me>
Acked-by: David Howells <dhowells@redhat.com>
Message-Id: <20230605143616.640517-1-code@siddh.me>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Diffstat (limited to 'include/linux/watch_queue.h')
| -rw-r--r-- | include/linux/watch_queue.h | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/include/linux/watch_queue.h b/include/linux/watch_queue.h index fc6bba20273b..45cd42f55d49 100644 --- a/include/linux/watch_queue.h +++ b/include/linux/watch_queue.h @@ -38,7 +38,7 @@ struct watch_filter { struct watch_queue { struct rcu_head rcu; struct watch_filter __rcu *filter; - struct pipe_inode_info *pipe; /* The pipe we're using as a buffer */ + struct pipe_inode_info *pipe; /* Pipe we use as a buffer, NULL if queue closed */ struct hlist_head watches; /* Contributory watches */ struct page **notes; /* Preallocated notifications */ unsigned long *notes_bitmap; /* Allocation bitmap for notes */ @@ -46,7 +46,6 @@ struct watch_queue { spinlock_t lock; unsigned int nr_notes; /* Number of notes */ unsigned int nr_pages; /* Number of pages in notes[] */ - bool defunct; /* T when queues closed */ }; /* |