This is a note to let you know that I've just added the patch titled Subject:[PATCH 2/5] eventfs: Remove "is_freed" union with rcu head to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: eventfs-remove-is_freed-union-with-rcu-head.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From stable-owner@xxxxxxxxxxxxxxx Sun Nov 5 17:01:44 2023 From: Steven Rostedt <rostedt@xxxxxxxxxxx> Date: Sun, 05 Nov 2023 10:56:32 -0500 Subject:[PATCH 2/5] eventfs: Remove "is_freed" union with rcu head To: linux-kernel@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx, <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: Masami Hiramatsu <mhiramat@xxxxxxxxxx>, Mark Rutland <mark.rutland@xxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, Ajay Kaher <akaher@xxxxxxxxxx> Message-ID: <20231105160139.498444992@xxxxxxxxxxx> From: Steven Rostedt <rostedt@xxxxxxxxxxx> From: "Steven Rostedt (Google)" <rostedt@xxxxxxxxxxx> commit f2f496370afcbc5227d7002da28c74b91fed12ff upstream The eventfs_inode->is_freed was a union with the rcu_head with the assumption that when it was on the srcu list the head would contain a pointer which would make "is_freed" true. But that was a wrong assumption as the rcu head is a single link list where the last element is NULL. Instead, split the nr_entries integer so that "is_freed" is one bit and the nr_entries is the next 31 bits. As there shouldn't be more than 10 (currently there's at most 5 to 7 depending on the config), this should not be a problem. Link: https://lkml.kernel.org/r/20231101172649.049758712@xxxxxxxxxxx Cc: stable@xxxxxxxxxxxxxxx Cc: Mark Rutland <mark.rutland@xxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Ajay Kaher <akaher@xxxxxxxxxx> Fixes: 63940449555e7 ("eventfs: Implement eventfs lookup, read, open functions") Reviewed-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> Signed-off-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/tracefs/event_inode.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -38,6 +38,7 @@ struct eventfs_inode { * @fop: file_operations for file or directory * @iop: inode_operations for file or directory * @data: something that the caller will want to get to later on + * @is_freed: Flag set if the eventfs is on its way to be freed * @mode: the permission that the file or directory should have */ struct eventfs_file { @@ -52,15 +53,14 @@ struct eventfs_file { * Union - used for deletion * @del_list: list of eventfs_file to delete * @rcu: eventfs_file to delete in RCU - * @is_freed: node is freed if one of the above is set */ union { struct list_head del_list; struct rcu_head rcu; - unsigned long is_freed; }; void *data; - umode_t mode; + unsigned int is_freed:1; + unsigned int mode:31; }; static DEFINE_MUTEX(eventfs_mutex); @@ -814,6 +814,8 @@ static void eventfs_remove_rec(struct ev } } + ef->is_freed = 1; + list_del_rcu(&ef->list); list_add_tail(&ef->del_list, head); } Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are queue-6.6/eventfs-use-simple_recursive_removal-to-clean-up-dentries.patch queue-6.6/eventfs-delete-eventfs_inode-when-the-last-dentry-is-freed.patch queue-6.6/eventfs-save-ownership-and-mode.patch queue-6.6/tracing-have-trace_event_file-have-ref-counters.patch queue-6.6/eventfs-remove-is_freed-union-with-rcu-head.patch