> tracefs_d_revalidate() reads ->is_freed of the eventfs_inode that
> dentry->d_fsdata points to, and ->d_revalidate() is called in rcu
> pathwalk mode with nothing but rcu_read_lock() held. The dentry itself
> stays around for such a walker, but tracefs_d_release() drops its
> reference to the eventfs_inode when the dentry is killed, and
> release_ei() then frees it after a grace period of eventfs_srcu. An
> SRCU grace period doesn't wait for rcu_read_lock() sections, so the
> walker can read an eventfs_inode that is already gone.
>
> With a pathwalk held up in tracefs_d_revalidate() while the dentry goes
> away:
>
> BUG: KASAN: slab-use-after-free in tracefs_d_revalidate+0x76/0x90
> Read of size 1 at addr ff1100010152d8d0 by task walker/97
> Call Trace:
> [ ... ]
> chain call_rcu() from the SRCU callback.
>
> Fixes: 8e556432477e ("eventfs: Use SRCU for freeing eventfs_inodes")
> Cc: [email protected]
> Signed-off-by: Christian Brauner (Amutable) <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review ยท
https://sashiko.dev/#/patchset/[email protected]?part=4
