From a0ded9d0d49ee95da87c8696ebd4ce67c37d9efc Mon Sep 17 00:00:00 2001 From: wangbowen6 Date: Fri, 25 Nov 2022 23:33:22 +0800 Subject: [PATCH] fs_epoll: [bug fix] epoll node use-after-free in epoll extend list Signed-off-by: wangbowen6 --- fs/vfs/fs_epoll.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/vfs/fs_epoll.c b/fs/vfs/fs_epoll.c index 0886c7c5a2b..0e179cec6f8 100644 --- a/fs/vfs/fs_epoll.c +++ b/fs/vfs/fs_epoll.c @@ -171,6 +171,7 @@ static int epoll_do_close(FAR struct file *filep) { FAR epoll_head_t *eph = filep->f_priv; FAR epoll_node_t *epn; + FAR epoll_node_t *tmp; int ret; ret = nxmutex_lock(&eph->lock); @@ -189,7 +190,7 @@ static int epoll_do_close(FAR struct file *filep) poll_fdsetup(epn->pfd.fd, &epn->pfd, false); } - list_for_every_entry(&eph->extend, epn, epoll_node_t, node) + list_for_every_entry_safe(&eph->extend, epn, tmp, epoll_node_t, node) { kmm_free(epn); }