eventpoll: use-after-possible-free in epoll_create1()

Al Viro · Al Viro · commit 98022748f6c7 · 2012-08-22T10:26:55.000-04:00
As soon as we'd installed the file into descriptor table, it can
get closed by another thread.  Freeing ep in process...

Signed-off-by: Al Viro &lt;viro@zeniv.linux.org.uk&gt;
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
@@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
 		error = PTR_ERR(file);
 		goto out_free_fd;
 	}
-	fd_install(fd, file);
 	ep->file = file;
+	fd_install(fd, file);
 	return fd;
 
 out_free_fd:

Original file line number	Diff line number	Diff line change
`@@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)`
`1654`	`1654`	`error = PTR_ERR(file);`
`1655`	`1655`	`goto out_free_fd;`
`1656`	`1656`	`}`
`1657`		`- fd_install(fd, file);`
`1658`	`1657`	`ep->file = file;`
	`1658`	`+ fd_install(fd, file);`
`1659`	`1659`	`return fd;`
`1660`	`1660`
`1661`	`1661`	`out_free_fd:`