From: Christian Brauner <brauner@kernel.org> stable inclusion from stable-v6.18.33 commit 9348f4763aa9b9e97fb006edc7aabd2aa209e5eb category: cleanup bugzilla: https://atomgit.com/src-openeuler/kernel/issues/15497 CVE: CVE-2026-46242 Reference: https://web.git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/... -------------------------------- [ Upstream commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b ] Replace the open-coded "epi is the only entry in file->f_ep" check with hlist_is_singular_node(). Same semantics, and the helper avoids the head-cacheline access in the common false case. Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.or... Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org> Stable-dep-of: a6dc643c6931 ("eventpoll: fix ep_remove struct eventpoll / struct file UAF") Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Zizhi Wo <wozizhi@huawei.com> --- fs/eventpoll.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/eventpoll.c b/fs/eventpoll.c index 8a556560a5b2..4f05d12a0503 100644 --- a/fs/eventpoll.c +++ b/fs/eventpoll.c @@ -743,11 +743,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) return false; } to_free = NULL; head = file->f_ep; - if (head->first == &epi->fllink && !epi->fllink.next) { + if (hlist_is_singular_node(&epi->fllink, head)) { /* See eventpoll_release() for details. */ WRITE_ONCE(file->f_ep, NULL); if (!is_file_epoll(file)) { struct epitems_head *v; v = container_of(head, struct epitems_head, epitems); -- 2.52.0