> From: Shuangpeng Bai <[email protected]> > > eventfs_remove_rec() recursively removes the child at the current loop > position. After the recursive call returns, list_for_each_entry() advances > by reading list.next from the removed child. > > If free_ei() drops the final reference, release_ei() reuses the list/rcu > union to queue an SRCU callback. The child may be freed before that read. > The eventfs_mutex serializes list updates, but it does not keep the removed > child alive or prevent the SRCU callback from running. > > Use list_for_each_entry_safe() to save the next sibling before recursively > removing the current child. > > Cc: [email protected] > Fixes: 43aa6f97c2d0 ("eventfs: Get rid of dentry pointers without refcounts") > Link: > https://patch.msgid.link/[email protected] > Signed-off-by: Shuangpeng Bai <[email protected]> > Acked-by: Masami Hiramatsu (Google) <[email protected]> > Signed-off-by: Steven Rostedt <[email protected]> > (cherry picked from commit fd73b691702170d37d66f4b0278530cea8ed419a) > > https://virtuozzo.atlassian.net/browse/VSTOR-154529 > Feature: fix ms/tracefs > > Signed-off-by: Eva Kurchatova <[email protected]>
This patch is unchanged since "[Devel] [PATCH hci-8.1 1/4] ms/eventfs: Fix use-after-free in eventfs_remove_rec()", which Sashiko reviewed and found no issues in. That review applies to this posting unaltered, so the patch has not been reviewed again. -- Sashiko AI review ยท https://sashiko.vzint.dev/#/patchset/[email protected]?part=1 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
