[PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

[PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

[Deepanshu Kartikey]

eventfs_create_events_dir() allocates the eventfs_inode via
alloc_root_ei(), but only calls INIT_LIST_HEAD() on ei->children
and ei->list after the tracefs_get_inode() check. If that check
fails, the code jumps to the fail label and calls cleanup_ei(),
which calls free_ei():

	WARN_ON_ONCE(!list_empty(&ei->children));

Since ei was allocated with kzalloc(), ei->children.next is NULL
at this point, not a self-referencing pointer. list_empty() checks
head->next == head, so it returns false on an uninitialized list
head, triggering a false-positive WARN_ON_ONCE() even though the
list was never used.

eventfs_create_dir() has the same latent issue: alloc_ei() is
called before INIT_LIST_HEAD(), leaving a window where an early
failure path could hit cleanup_ei() on an uninitialized list head.

Move the INIT_LIST_HEAD() calls into init_ei(), which is called
by both alloc_ei() and alloc_root_ei() immediately after
allocation. This guarantees every eventfs_inode has a valid,
self-linked, empty children/list the moment it is allocated,
regardless of which failure path runs afterward.

Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode")
Reported-by: syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 fs/tracefs/event_inode.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 604ba3e841d2..6e3513b13cfa 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -438,6 +438,8 @@ static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char
 	if (!ei->name)
 		return NULL;
 	kref_init(&ei->kref);
+	INIT_LIST_HEAD(&ei->children);
+	INIT_LIST_HEAD(&ei->list);
 	return ei;
 }
 
@@ -729,8 +731,6 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
 	ei->entries = entries;
 	ei->nr_entries = size;
 	ei->data = data;
-	INIT_LIST_HEAD(&ei->children);
-	INIT_LIST_HEAD(&ei->list);
 
 	scoped_guard(mutex, &eventfs_mutex) {
 		if (!parent->is_freed)
@@ -802,9 +802,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
 	ei->attr.uid = uid;
 	ei->attr.gid = gid;
 
-	INIT_LIST_HEAD(&ei->children);
-	INIT_LIST_HEAD(&ei->list);
-
 	ti = get_tracefs(inode);
 	ti->flags |= TRACEFS_EVENT_INODE;
 	ti->private = ei;
-- 
2.34.1

Re: [PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

[Steven Rostedt]

On Mon, 24 Aug 2026 20:16:53 +0530
Deepanshu Kartikey <kartikey406@gmail.com> wrote:

Yeah, I saw the syzbot report and came up immediately with this fix as
well. But the change log is way too verbose for such a simple fix. Did
you use AI for this patch? If so, you must divulge that information,
usually with a tag.

> eventfs_create_events_dir() allocates the eventfs_inode via
> alloc_root_ei(), but only calls INIT_LIST_HEAD() on ei->children
> and ei->list after the tracefs_get_inode() check. If that check
> fails, the code jumps to the fail label and calls cleanup_ei(),
> which calls free_ei():
> 
> 	WARN_ON_ONCE(!list_empty(&ei->children));
> 
> Since ei was allocated with kzalloc(), ei->children.next is NULL
> at this point, not a self-referencing pointer. list_empty() checks
> head->next == head, so it returns false on an uninitialized list
> head, triggering a false-positive WARN_ON_ONCE() even though the
> list was never used.
> 
> eventfs_create_dir() has the same latent issue: alloc_ei() is
> called before INIT_LIST_HEAD(), leaving a window where an early
> failure path could hit cleanup_ei() on an uninitialized list head.
> 
> Move the INIT_LIST_HEAD() calls into init_ei(), which is called
> by both alloc_ei() and alloc_root_ei() immediately after
> allocation. This guarantees every eventfs_inode has a valid,
> self-linked, empty children/list the moment it is allocated,
> regardless of which failure path runs afterward.

The change log only needs to say:

  eventfs_create_dir() allocates the eventfs_inode and initializes it
  with init_ei(). But this does not initialize the eventfs_inode
  list_heads. If the eventfs_create_dir() fails due to memory pressure,
  it will call free_ei() which checks to make sure the eventfs_inode
  has no children. But because the list wasn't initialized, it will
  give a false warning.

  Fix it by moving the list initialization into init_ei().

See, much better. Right to the point without all the AI slop.

I'll take your patch, but I'm replacing the commit log with the above.

-- Steve


> 
> Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode")
> Reported-by: syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06
> Cc: stable@vger.kernel.org
> Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
> ---
>  fs/tracefs/event_inode.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
> index 604ba3e841d2..6e3513b13cfa 100644
> --- a/fs/tracefs/event_inode.c
> +++ b/fs/tracefs/event_inode.c
> @@ -438,6 +438,8 @@ static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char
>  	if (!ei->name)
>  		return NULL;
>  	kref_init(&ei->kref);
> +	INIT_LIST_HEAD(&ei->children);
> +	INIT_LIST_HEAD(&ei->list);
>  	return ei;
>  }
>  
> @@ -729,8 +731,6 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
>  	ei->entries = entries;
>  	ei->nr_entries = size;
>  	ei->data = data;
> -	INIT_LIST_HEAD(&ei->children);
> -	INIT_LIST_HEAD(&ei->list);
>  
>  	scoped_guard(mutex, &eventfs_mutex) {
>  		if (!parent->is_freed)
> @@ -802,9 +802,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
>  	ei->attr.uid = uid;
>  	ei->attr.gid = gid;
>  
> -	INIT_LIST_HEAD(&ei->children);
> -	INIT_LIST_HEAD(&ei->list);
> -
>  	ti = get_tracefs(inode);
>  	ti->flags |= TRACEFS_EVENT_INODE;
>  	ti->private = ei;

Re: [PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

[Deepanshu Kartikey]

On Mon, Aug 24, 2026 at 8:33 PM Steven Rostedt <rostedt@goodmis.org> wrote:
>
> On Mon, 24 Aug 2026 20:16:53 +0530
> Deepanshu Kartikey <kartikey406@gmail.com> wrote:
>
> Yeah, I saw the syzbot report and came up immediately with this fix as
> well. But the change log is way too verbose for such a simple fix. Did
> you use AI for this patch? If so, you must divulge that information,
> usually with a tag.
>

Yes , I have used AI to create a commit log . I will add the tag in v2
and the commit
log you have suggested.

Thanks

Deepanshu

Re: [PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

[Steven Rostedt]

On Tue, 25 Aug 2026 06:53:55 +0530
Deepanshu Kartikey <kartikey406@gmail.com> wrote:

> On Mon, Aug 24, 2026 at 8:33 PM Steven Rostedt <rostedt@goodmis.org> wrote:
> >
> > On Mon, 24 Aug 2026 20:16:53 +0530
> > Deepanshu Kartikey <kartikey406@gmail.com> wrote:
> >
> > Yeah, I saw the syzbot report and came up immediately with this fix as
> > well. But the change log is way too verbose for such a simple fix. Did
> > you use AI for this patch? If so, you must divulge that information,
> > usually with a tag.
> >  
> 
> Yes , I have used AI to create a commit log . I will add the tag in v2
> and the commit
> log you have suggested.
> 

No need. I pulled your patch and just rewrote the change log. It's now
in my queue.

Thanks,

-- Steve