[SRU][N:linux-hwe-6.17][PATCH 1/1] eventpoll: defer struct eventpoll free to RCU grace period

[jose.ogando at canonical.com]

Hello,

Thanks for your submission.

We are currently in the process of retiring 6.17 kernels including
linux-hwe-6.17 in favor of a newer hardware enablement kernel. 

https://ubuntu.com/kernel/lifecycle

Any submissions or activity in the 6.17 tree should not be interpreted
as this kernel still being maintained. We encourage users to move to
supported kernels.

We won't be taking those patches, however, we should let you know that
we have or are addressing two of the important vulnerabilities that you
are patching here soon in some other kernels.

https://ubuntu.com/security/CVE-2026-43499
https://ubuntu.com/security/CVE-2026-46242

Regards,

Jose. 

On Mon, 2026-07-20 at 01:19 +0200, Fedor Veselovskii wrote:
> From: Nicholas Carlini <nicholas at carlini.com>
> 
> An RCU epoll graph traversal can retain a reference to an eventpoll
> object after ep_free() has begun. Defer freeing the object until an
> RCU grace period has elapsed so graph readers cannot access released
> memory.
> 
> Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion")
> Signed-off-by: Nicholas Carlini <nicholas at carlini.com>
> Signed-off-by: Christian Brauner <brauner at kernel.org>
> 
> (backported from commit 07712db80857d5d09ae08f3df85a708ecfc3b61f)
> [Fedor Veselovskii: Applied the two upstream lifetime changes
> manually
> to Ubuntu 6.17's eventpoll implementation.]
> Assisted-by: ChatGPT:GPT-5.6 Thinking
> CVE-2026-43074
> Signed-off-by: Fedor Veselovskii <asetium at gmail.com>
> ---
>  fs/eventpoll.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/eventpoll.c b/fs/eventpoll.c
> index ee7c4b683..547b94556 100644
> --- a/fs/eventpoll.c
> +++ b/fs/eventpoll.c
> @@ -226,6 +226,9 @@ struct eventpoll {
>  	 */
>  	refcount_t refcount;
>  
> +	/* used to defer freeing past ep_get_upwards_depth_proc()
> RCU walk */
> +	struct rcu_head rcu;
> +
>  #ifdef CONFIG_NET_RX_BUSY_POLL
>  	/* used to track busy poll napi_id */
>  	unsigned int napi_id;
> @@ -819,7 +822,8 @@ static void ep_free(struct eventpoll *ep)
>  	mutex_destroy(&ep->mtx);
>  	free_uid(ep->user);
>  	wakeup_source_unregister(ep->ws);
> -	kfree(ep);
> +	/* ep_get_upwards_depth_proc() may still hold epi->ep under
> RCU */
> +	kfree_rcu(ep, rcu);
>  }
>  
>  /*
> -- 
> 2.43.0
>