From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f43.google.com (mail-wm1-f43.google.com [209.85.128.43]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 315A32D3A93 for ; Tue, 25 Aug 2026 21:57:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.43 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787695069; cv=none; b=MztDah0+7NqMRpMcQYQawk6ox5Dj9pYNQyq4J8+M+61ABsBm/aF2Wi3t/32IqUgzKHFTZHSV9c5/AakwU6ojtlYt+OFXafeEbhXe7uobUeygTMHVNECgrHrybnLmKpSekcjAl8iv2xcCbfhxZMTaQsraQALkNhsktdUN7JrVuqc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787695069; c=relaxed/simple; bh=JfEx9R90DbtsDady/cwL0vwAaFNOuM16zMYkRtcsrSw=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=XipB+q4DtNkgSc2wQX59XZVUn20XkXeVbJ7wriXgN4R6D2ud6gl7IhgNjJsFj98SHiDowmolmXGhwo9gVcgzAbJ6d7xDE6fSzAiplGihaXgUvNE+xIfHPDriulrKuZPA8Xv+P9JsXgH2z1SjV4JRbzyYFIaYtpFmJPpGgz7ZpGk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=YsaclQTh; arc=none smtp.client-ip=209.85.128.43 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="YsaclQTh" Received: by mail-wm1-f43.google.com with SMTP id 5b1f17b1804b1-4955aa106b1so2208885e9.0 for ; Tue, 25 Aug 2026 14:57:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1787695066; x=1788299866; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=8SetAdNEzl5Es+rjASEVAa0Ps4/t5B2aWVxxD5JLYZU=; b=YsaclQThIDZiRmcS0juy1/h5Z6FFuX3DRB/EPqQAjhpAicWTBvzUpJSOL38NmcXKUf QIcxFEk0YiNITBnyV60bPMltwhOwLMwt/0ou1nwUNlSt0ly2oCJTTIDKr9s91U1n0GlM 3DzQ7gqM4qlHIAWkJq71QiJf4/y8M1cjE4Bakxdikl4mPWn2FhX2NkPEfWy/cJ6QK92w 08W9Qnt+TAfsRC63zgiUReOtXCp6LBvfkHf3GXbMCevV7d8n3KrBW95couplJtX+/gzs OfsD2Rr2CFb2ohNZSzRxme217cGPBJf3bRax9j1jDWA/fjHsGFPXfOinj0ITAOrRuAIm INrw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787695066; x=1788299866; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=8SetAdNEzl5Es+rjASEVAa0Ps4/t5B2aWVxxD5JLYZU=; b=UCn3e7NsVHiXAUQ9CgaZUU7laV+xv5STnSfHUoPdD+frYwYW07XdS+P5Z+hEnRbvi6 ab+szuoj76LfDpERFhkgBsf0q9vDCqOGrAk8W9Ux4WR+/omRaeRI1aKuQypEgNVu/QhH H4ISfBeLr7+lYNYpZpPQa703vt3puXQYzNZnAXKrphoCqwnq3HRwK5gFiGMzpEwTh9vp 9NjofbvGYk3sPP3go8Z8d3QjvBEm1ITokcdNAkP7VV3hJyf4NgMYJc15w8bSgj8DwiVn YfNINljFoZs4f9iiXeZHkiCYqcNHidr8bjKA9gYsF07sUAUnFO6mNmckCXosAMfjalan xEZw== X-Forwarded-Encrypted: i=1; AHgh+Rq39wrCp7Oe2p0drEyljHarUkRUN7sh6eaIJ/m9NDoBn1HLmDg9I9AG6kf7ftjQEUQ0wCT7M0YaPgBJk8s=@vger.kernel.org X-Gm-Message-State: AFuF++nFTbu8lLy4L9xlla2Ro3cBeQDCt5/MvbwFVRURwtnOeOLCUu2y moPgXD0Ss7qxpzRJTsPl1jMomyZ5iZjqn0cliKRq9DD6PsyTZYeWmqGt X-Gm-Gg: AR+sD12XO2sIxR8Z0+zKYZBnHnPQ7wtjUEpmOqnmrZyZYpUb4YYJHOvB6elC/S/Lyrq 0XYQxzK11Njl+oHMAuZM4UcZ+9f/NTdmShwMq1ptgL5XcrFXQNxRTIumoTx4HcTLCZs1jBQ5RP5 A3PQLvKbDZQXKGVb845Fj++BHX2NL4ww7YNNxzF/3ZDwE8qff0fLJ2rvgRCeeY/QJbWDPAyrtNa /nnZvsw+KqXDiITGG15eb03NLcDYsD+ykwVvwrhGHmm/IQFB+xKICubGfPyBF7e6odgENYkMBhB d/iq8GxHPZOULDtuu1TrRbzppfjIQI9xK9joE4spp55h+D9xuO5q2x+MAHCVLUXwYPMwCC/dkiI NIcSomNbbN9cUYSydNHVKSDE3iiPAjH2tAFOuafXon2+7U4AXC2XrNKxm/ycJUPHehIQb7UgPaV Ee2Wkt85lSgpiXeEhp57ofe7s090sO6Ed72OaMcQuN2XC1xQcecLipWO21rsvpZexNb2IzZ2B4Z 7ReKVtlWugCc/HX32c0qAGIwOifXBDGkXk9lHg2lAz6L+sj X-Received: by 2002:a05:600c:8b85:b0:497:ff73:68d5 with SMTP id 5b1f17b1804b1-499dc6a2cbfmr17069205e9.0.1787695066192; Tue, 25 Aug 2026 14:57:46 -0700 (PDT) Received: from dohko.chello.ie (188-141-5-72.dynamic.upc.ie. [188.141.5.72]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-499dca8c75csm5989185e9.2.2026.08.25.14.57.29 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 25 Aug 2026 14:57:29 -0700 (PDT) From: David Carlier To: rostedt@goodmis.org, mhiramat@kernel.org Cc: mathieu.desnoyers@efficios.com, linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org, David Carlier Subject: [PATCH] eventfs: Initialise ei->children before it can be freed Date: Tue, 25 Aug 2026 22:57:18 +0100 Message-ID: <20260825215727.200803-1-devnexen@gmail.com> X-Mailer: git-send-email 2.55.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit eventfs_create_events_dir() runs INIT_LIST_HEAD(&ei->children) only after tracefs_get_inode() succeeds, but that call's failure path jumps to "fail", which calls cleanup_ei() and then free_ei(). free_ei() reads the list with WARN_ON_ONCE(!list_empty(&ei->children)), and alloc_root_ei() uses kzalloc(), so children.next is NULL there and the WARN fires. The path is reachable at runtime: mkdir /sys/kernel/tracing/instances/foo ends up in create_event_toplevel_files() and eventfs_create_events_dir(). Move both INIT_LIST_HEAD() calls up to right after the allocation. Fixes: f0ece16ffca7 ("eventfs: Use children field for rcu head and add memory barriers") Signed-off-by: David Carlier --- fs/tracefs/event_inode.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 604ba3e841d2..1d9edc99ff3f 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -779,6 +779,9 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry if (!ei) goto fail; + INIT_LIST_HEAD(&ei->children); + INIT_LIST_HEAD(&ei->list); + inode = tracefs_get_inode(dentry->d_sb); if (unlikely(!inode)) goto fail; @@ -802,9 +805,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry ei->attr.uid = uid; ei->attr.gid = gid; - INIT_LIST_HEAD(&ei->children); - INIT_LIST_HEAD(&ei->list); - ti = get_tracefs(inode); ti->flags |= TRACEFS_EVENT_INODE; ti->private = ei; -- 2.55.0