Re: [PATCH] eventfs: Initialise ei->children before it can be freed
From: Steven Rostedt <rostedt@goodmis.org>
Date: 2026-08-25 22:28:16
Also in:
lkml
On Tue, 25 Aug 2026 22:57:18 +0100 David Carlier [off-list ref] wrote:
eventfs_create_events_dir() runs INIT_LIST_HEAD(&ei->children) only after
tracefs_get_inode() succeeds, but that call's failure path jumps to "fail",
which calls cleanup_ei() and then free_ei(). free_ei() reads the list with
WARN_ON_ONCE(!list_empty(&ei->children)), and alloc_root_ei() uses
kzalloc(), so children.next is NULL there and the WARN fires.
The path is reachable at runtime: mkdir /sys/kernel/tracing/instances/foo
ends up in create_event_toplevel_files() and eventfs_create_events_dir().
Move both INIT_LIST_HEAD() calls up to right after the allocation.
Fixes: f0ece16ffca7 ("eventfs: Use children field for rcu head and add memory barriers")
Signed-off-by: David Carlier <redacted>Already queued by someone else. https://patch.msgid.link/20260824144653.54044-1-kartikey406@gmail.com -- Steve