From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f177.google.com (mail-qk1-f177.google.com [209.85.222.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 95B303ACA77 for ; Thu, 6 Aug 2026 02:27:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.177 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785983257; cv=none; b=KkXZeaJR8T36O4GK04umUwc+sWwTJd1krSQ78sSjB4SiTZCrL0Kle5LRN63LVZu0jVsQGFEWDfNDVzIrq+jNoii0XRczoKyGgjehP9aKWIjwSXiqrMmGxZ2A5mqqpPYZ7EmzqrpL7IhZRd/gvNzfGwduObOZdq24VcKDxrVXUpY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785983257; c=relaxed/simple; bh=mWYaaJ95WFSIgwaj7DsE8799Djlnld1MLckIrfE585I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=eqN2Wk3xbklaF55X6XfJYPsPCN9k5GvROLkwPvlnT8gZDMLR7488BaGDW51ecmIgBrbzcJVxs5aNzM8sKtkexn3c8ku20/5mGwpSkh4fJE5BxofD9rxjmsK/y3ZHRsrvFIep2XtgV2qrL41ELb+CtRiWP/k+iL7ewGvUg7hwPxk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sPb/+Ylt; arc=none smtp.client-ip=209.85.222.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sPb/+Ylt" Received: by mail-qk1-f177.google.com with SMTP id af79cd13be357-92e53581361so98981485a.1 for ; Wed, 05 Aug 2026 19:27:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785983254; x=1786588054; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Hysdgtb7wp/8HlGZYxSnsEh9b9oJvSSZRpXBcjKX6ew=; b=sPb/+YltBgId2YtErMZpO1BjQeXqOy9tSMLfM1UoXrhKR+TfRxxz1ZFg2kF/rEdYcW vNQQT50sSsdwIGbf6UEQW/oAnOy0LB1IrpzKbIF5U1NlfFdcLAmwBfd6xwGEUpHYESfV CYFFzpBmixri9Hb4gky2l7xp4AK6KmAjInF9IyRm4lpc4bZmGotrbX/dSvbf5S8hbqZV BGywAfGbdp1boikENpvsR5Wk2m2sb9rrQ6hgsl2MQF0/LtMFatvvFRdGVoaKLZhFplEr TBxLyu5oAXCsmyPR9eCAGg4FzHI9LpDsNFSwx7IpgR0wI12VtUvhOGjm0hWV65UehK/M Goug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785983254; x=1786588054; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Hysdgtb7wp/8HlGZYxSnsEh9b9oJvSSZRpXBcjKX6ew=; b=p4Uj0eYj3XdOEnJ44ktXT3sb3mS/X4Yds3mvABfbFDWJx8kYpoednogAWv18Uu87nm qpRcb3kyt9hi0AJtpql422VyZN89XNjRuLXhuQtOTgJUrI49xwUuR7kT5xlcSN2M/qHo wS4HiVsKmyCTWdcJR3n2LBs8lxbH7RrppzCb/xEvUrSdkDcPgFizvhJ8+u3RjQEy6ez1 GSITf184DMHz7C6KxQWcXwfZnDEqpq8RhxxPz3cN82k8YTM2ej9yMKl00nvyE8AZUzIR qQnRjUVB9vPzwgV5uvBuoohIJWmSiPvKX8nBggeXJ/y0QiK3Jy9xf+/xTliVWrszO4SJ NkfQ== X-Forwarded-Encrypted: i=1; AHgh+RoA4x0w/hOhxSc+VuN5tGngsfW18sk7u43fW0EmEs2noRSZSHNaQjCqPEiTpjcqw/RTLGPZymj/JDGZy+Y=@vger.kernel.org X-Gm-Message-State: AOJu0Yx29KWTomYxnjWI2V+VE5DYFNe8/kW1wO8QeJzAeg4JrBwwPaT2 uChUEzvwz7+bd/MP89z2iFO83CxVRA1TRKShndXvdtT3l+VeoZM7TFU074n6yQJR X-Gm-Gg: AR+sD11/RSAaLdXGY+PLohHNjJGLnqW9QzwHrv+0D0rmew3ljOg3GRiXiidxbxJJHit phZ0mFcVnKmU7Ih43JjXkB6gteDvUUDwAS+fyB4lBf83Ox41GUoeX3amEK2VgXFe4w8sFHYjFoA qek7IPgr8CdMxgx8AJ24990zTM6TiPtQaBemmlC2qNnXQGym9YMDdbNh0AB4AbCLi4oiv1jmGUj /DT1y6wrePDnF5EWXtsW2RqUZBqy2ktXUym+PqNchEJB5WrcMTW32Zxl3waJGE4hnsF62HjDa7X BdecwSd7UE3SyuahnlsaCxqlsTBWwYvmvGOO5UtmIq8SmylXu1iRRpn/mPcKwlCD12pLv4n08pM Vjl7stOZCRGPbfDhjGABPn3pB8ohkANO7iAfgBz7F5g76Adndn/+Z/Q+AMZhk5XdXAMytG9Ysak SLw+N/RBt8YGGkIMLiS0ZCR+zteJIgjj9BTQ2Ll+wrS+uhXM725JCos20KrU2U1DM17M6lU+ZET CwtnKFhCkJVPoh0Ew== X-Received: by 2002:a05:620a:28cd:b0:925:56bc:b8bb with SMTP id af79cd13be357-93648fafb5bmr1088990485a.9.1785983254432; Wed, 05 Aug 2026 19:27:34 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id af79cd13be357-93657630fddsm157474385a.8.2026.08.05.19.27.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 05 Aug 2026 19:27:33 -0700 (PDT) From: Shuangpeng Bai To: Steven Rostedt , Masami Hiramatsu Cc: Mathieu Desnoyers , linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, Shuangpeng Bai , stable@vger.kernel.org Subject: [PATCH] eventfs: Fix use-after-free in eventfs_remove_rec() Date: Wed, 5 Aug 2026 22:27:19 -0400 Message-ID: <20260806022719.375354-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit eventfs_remove_rec() recursively removes the child at the current loop position. After the recursive call returns, list_for_each_entry() advances by reading list.next from the removed child. If free_ei() drops the final reference, release_ei() reuses the list/rcu union to queue an SRCU callback. The child may be freed before that read. The eventfs_mutex serializes list updates, but it does not keep the removed child alive or prevent the SRCU callback from running. Use list_for_each_entry_safe() to save the next sibling before recursively removing the current child. Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") Cc: stable@vger.kernel.org Signed-off-by: Shuangpeng Bai --- fs/tracefs/event_inode.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 39c7a34531e8..93bc4f83b73e 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -822,7 +822,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry */ static void eventfs_remove_rec(struct eventfs_inode *ei, int level) { - struct eventfs_inode *ei_child; + struct eventfs_inode *ei_child, *tmp; /* * Check recursion depth. It should never be greater than 3: @@ -835,7 +835,7 @@ static void eventfs_remove_rec(struct eventfs_inode *ei, int level) return; /* search for nested folders or files */ - list_for_each_entry(ei_child, &ei->children, list) + list_for_each_entry_safe(ei_child, tmp, &ei->children, list) eventfs_remove_rec(ei_child, level + 1); list_del_rcu(&ei->list); -- 2.43.0