Re: another use-after-free in ep_remove_wait_queue()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 8 Jan 2023 14:25:48 -0800 PM Munehisa Kamata <kamatam@xxxxxxxxxx> wrote:
> 
> That patch survived the repro in my original post, however, the waker
> (rmdir) was getting stuck until a file descriptor of the epoll instance or
> the pressure file got closed. So, if the following modified repro runs
> with the patch, the waker never returns (unless the sleeper gets killed)
> while holding cgroup_mutex. This doesn't seem to be what you expected to
> see with the patch, does it? Even wake_up_all() does not appear to empty
> the queue, but wake_up_pollfree() does.

Thanks for your testing. And the debugging completes.

Mind sending a patch with wake_up_pollfree() folded?

Hillf




[Index of Archives]     [Linux ARM Kernel]     [Linux ARM]     [Linux Omap]     [Fedora ARM]     [IETF Annouce]     [Bugtraq]     [Linux OMAP]     [Linux MIPS]     [eCos]     [Asterisk Internet PBX]     [Linux API]

  Powered by Linux