eventpoll: use-after-possible-free in epoll_create1()

As soon as we'd installed the file into descriptor table, it can get closed by another thread. Freeing ep in process... Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
2012-08-17 22:42:36 -04:00 · 2012-08-17 22:42:36 -04:00 · 98022748f6
parent 31605debdf
commit 98022748f6
1 changed files with 1 additions and 1 deletions
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@ -1654,8 +1654,8 @@ SYSCALL_DEFINE1(epoll_create1, int, flags)
 		error = PTR_ERR(file);
 		goto out_free_fd;
 	}
-	fd_install(fd, file);
 	ep->file = file;
+	fd_install(fd, file);
 	return fd;

 out_free_fd: