Re: [PATCH 2/2] tracefs: Don't overlay 'struct inode'

[Mathias Krause <minipli@grsecurity.net>]

On 07.08.24 17:49, Steven Rostedt wrote:
> [...]
> 
> So I could use destroy_inode() for the removing of the link list, and then
> free_inode to free it. Something like:
> 
> diff --git a/fs/tracefs/inode.c b/fs/tracefs/inode.c
> index 1028ab6d9a74..ae2cb2221acd 100644
> --- a/fs/tracefs/inode.c
> +++ b/fs/tracefs/inode.c
> @@ -53,15 +53,14 @@ static struct inode *tracefs_alloc_inode(struct super_block *sb)
>  	return &ti->vfs_inode;
>  }
>  
> -static void tracefs_free_inode_rcu(struct rcu_head *rcu)
> +static void tracefs_free_inode(struct inode *inode)
>  {
> -	struct tracefs_inode *ti;
> +	struct tracefs_inode *ti = get_tracefs(inode);
>  
> -	ti = container_of(rcu, struct tracefs_inode, rcu);
>  	kmem_cache_free(tracefs_inode_cachep, ti);
>  }
>  
> -static void tracefs_free_inode(struct inode *inode)
> +static void tracefs_destroy_inode(struct inode *inode)
>  {
>  	struct tracefs_inode *ti = get_tracefs(inode);
>  	unsigned long flags;
> @@ -69,8 +68,6 @@ static void tracefs_free_inode(struct inode *inode)
>  	spin_lock_irqsave(&tracefs_inode_lock, flags);
>  	list_del_rcu(&ti->list);
>  	spin_unlock_irqrestore(&tracefs_inode_lock, flags);
> -
> -	call_rcu(&ti->rcu, tracefs_free_inode_rcu);
>  }
>  
>  static ssize_t default_read_file(struct file *file, char __user *buf,
> @@ -437,6 +434,7 @@ static int tracefs_drop_inode(struct inode *inode)
>  static const struct super_operations tracefs_super_operations = {
>  	.alloc_inode    = tracefs_alloc_inode,
>  	.free_inode     = tracefs_free_inode,
> +	.destroy_inode  = tracefs_destroy_inode,
>  	.drop_inode     = tracefs_drop_inode,
>  	.statfs		= simple_statfs,
>  	.show_options	= tracefs_show_options,
> diff --git a/fs/tracefs/internal.h b/fs/tracefs/internal.h
> index f704d8348357..d83c2a25f288 100644
> --- a/fs/tracefs/internal.h
> +++ b/fs/tracefs/internal.h
> @@ -10,10 +10,7 @@ enum {
>  };
>  
>  struct tracefs_inode {
> -	union {
> -		struct inode            vfs_inode;
> -		struct rcu_head		rcu;
> -	};
> +	struct inode            vfs_inode;
>  	/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
>  	struct list_head	list;
>  	unsigned long           flags;
> 
> 
> I'll run this under some more tests and see if it doesn't crash.
> 
> I'll apply the first patch of this series too, and then probably use this
> one.

LGTM, will give it some testing here too.

Thanks,
Mathias