do_epoll_ctl(): clean the failure exits up a bit

commit 52c479697c9b73f628140dcdfcd39ea302d05482 upstream.

Mot-CRs-fixed: (CR)
CVE-Fixed: CVE-2020-0466
Bug: 147802478

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
Change-Id: I97468c95d3c22cc5f538dfcf78907aefa35a6503
Signed-off-by: Jignesh Patel <jignesh@motorola.com>
Reviewed-on: https://gerrit.mot.com/1796973
SLTApproved: Slta Waiver
SME-Granted: SME Approvals Granted
Tested-by: Jira Key
Reviewed-by: Xiangpo Zhao <zhaoxp3@motorola.com>
Submit-Approved: Jira Key
(cherry picked from commit 9210a4397626480be068aeb202b131c700f9804d)

diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index d791460f6329220e4213df4b1664f91659d3309a..e6fd4b9874a39ad9e96e1b7c2a84d9d9abb40ba4 100644 (file)
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -2101,10 +2101,8 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                        mutex_lock(&epmutex);
                        if (is_file_epoll(tf.file)) {
                                error = -ELOOP;
-                               if (ep_loop_check(ep, tf.file) != 0) {
-                                       clear_tfile_check_list();
+                               if (ep_loop_check(ep, tf.file) != 0)
                                        goto error_tgt_fput;
-                               }
                        } else {
                                get_file(tf.file);
                                list_add(&tf.file->f_tfile_llink,
@@ -2133,8 +2131,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                        error = ep_insert(ep, &epds, tf.file, fd, full_check);
                } else
                        error = -EEXIST;
-               if (full_check)
-                       clear_tfile_check_list();
                break;
        case EPOLL_CTL_DEL:
                if (epi)
@@ -2157,8 +2153,10 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
        mutex_unlock(&ep->mtx);
 
 error_tgt_fput:
-       if (full_check)
+       if (full_check) {
+               clear_tfile_check_list();
                mutex_unlock(&epmutex);
+       }
 
        fdput(tf);
 error_fput: