Re: [PATCH 4/8] eventfs: free the eventfs_inode after an rcu grace period too

[sashiko-bot@kernel.org]

> tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
> dentry->d_fsdata points to, and ->d_revalidate() is called in rcu
> pathwalk mode with nothing but rcu_read_lock() held. The dentry itself
> stays around for such a walker, but tracefs_d_release() drops its
> reference to the eventfs_inode when the dentry is killed, and
> release_ei() then frees it after a grace period of eventfs_srcu. An
> SRCU grace period doesn't wait for rcu_read_lock() sections, so the
> walker can read an eventfs_inode that is already gone.
> 
> With a pathwalk held up in tracefs_d_revalidate() while the dentry goes
> away:
> 
>   BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90
>   Read of size 1 at addr ff1100010152d8d0 by task walker/97
>   Call Trace:
> [ ... ]
> chain call_rcu() from the SRCU callback.
> 
> Fixes: 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes")
> Cc: stable@vger.kernel.org
> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261009-work-fixes-rcu-v1-0-7446d2d335e6@kernel.org?part=4