From: Christian Brauner <brauner@kernel.org> stable inclusion from stable-v6.18.33 commit e644f892e1f27b7ed21a513a62b42dc1ca62d468 category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15497 CVE: CVE-2026-46242 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/... -------------------------------- [ Upstream commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf ] With __ep_remove() gone, the double-underscore on __ep_remove_file() and __ep_remove_epi() no longer contrasts with a __-less parent and just reads as noise. Rename both to ep_remove_file() and ep_remove_epi(). No functional change. Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> Stable-dep-of: a6dc643c6931 ("eventpoll: fix ep_remove struct eventpoll / struct file UAF") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/eventpoll.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 766716c2fd92..0a54a4226357 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -717,11 +717,11 @@ static void ep_free(struct eventpoll *ep) /* * Called with &file->f_lock held, * returns with it released */ -static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, +static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) { struct epitems_head *to_free = NULL; struct hlist_head *head = file->f_ep; @@ -741,11 +741,11 @@ static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, hlist_del_rcu(&epi->fllink); spin_unlock(&file->f_lock); free_ephead(to_free); } -static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) +static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) { lockdep_assert_held(&ep->mtx); rb_erase_cached(&epi->rbn, &ep->rbr); @@ -787,13 +787,13 @@ static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) spin_lock(&file->f_lock); if (epi->dying) { spin_unlock(&file->f_lock); return; } - __ep_remove_file(ep, epi, file); + ep_remove_file(ep, epi, file); - if (__ep_remove_epi(ep, epi)) + if (ep_remove_epi(ep, epi)) WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); } static void ep_clear_and_put(struct eventpoll *ep) { @@ -1011,12 +1011,12 @@ void eventpoll_release_file(struct file *file) mutex_lock(&ep->mtx); ep_unregister_pollwait(ep, epi); spin_lock(&file->f_lock); - __ep_remove_file(ep, epi, file); - dispose = __ep_remove_epi(ep, epi); + ep_remove_file(ep, epi, file); + dispose = ep_remove_epi(ep, epi); mutex_unlock(&ep->mtx); if (dispose && ep_refcount_dec_and_test(ep)) ep_free(ep); -- 2.52.0