[SRU][N:linux-hwe-6.17][PATCH 1/1] eventpoll: defer struct eventpoll free to RCU grace period

[Fedor Veselovskii]

From: Nicholas Carlini <nicholas at carlini.com>

An RCU epoll graph traversal can retain a reference to an eventpoll
object after ep_free() has begun. Defer freeing the object until an
RCU grace period has elapsed so graph readers cannot access released
memory.

Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion")
Signed-off-by: Nicholas Carlini <nicholas at carlini.com>
Signed-off-by: Christian Brauner <brauner at kernel.org>

(backported from commit 07712db80857d5d09ae08f3df85a708ecfc3b61f)
[Fedor Veselovskii: Applied the two upstream lifetime changes manually
to Ubuntu 6.17's eventpoll implementation.]
Assisted-by: ChatGPT:GPT-5.6 Thinking
CVE-2026-43074
Signed-off-by: Fedor Veselovskii <asetium at gmail.com>
---
 fs/eventpoll.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index ee7c4b683..547b94556 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -226,6 +226,9 @@ struct eventpoll {
 	 */
 	refcount_t refcount;
 
+	/* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */
+	struct rcu_head rcu;
+
 #ifdef CONFIG_NET_RX_BUSY_POLL
 	/* used to track busy poll napi_id */
 	unsigned int napi_id;
@@ -819,7 +822,8 @@ static void ep_free(struct eventpoll *ep)
 	mutex_destroy(&ep->mtx);
 	free_uid(ep->user);
 	wakeup_source_unregister(ep->ws);
-	kfree(ep);
+	/* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */
+	kfree_rcu(ep, rcu);
 }
 
 /*
-- 
2.43.0