This is a note to let you know that I've just added the patch titled eventfs: Remove "is_freed" union with rcu head to the 6.6-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: eventfs-remove-is_freed-union-with-rcu-head.patch and it can be found in the queue-6.6 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From SRS0=eEWY=JP=rostedt.homelinux.com=rostedt@xxxxxxxxxx Tue Feb 6 13:09:21 2024 From: Steven Rostedt <rostedt@xxxxxxxxxxx> Date: Tue, 06 Feb 2024 07:09:21 -0500 Subject: eventfs: Remove "is_freed" union with rcu head To: linux-kernel@xxxxxxxxxxxxxxx, stable@xxxxxxxxxxxxxxx Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx>, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>, Sasha Levin <sashal@xxxxxxxxxx>, Masami Hiramatsu <mhiramat@xxxxxxxxxx>, Mark Rutland <mark.rutland@xxxxxxx>, Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>, Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>, Ajay Kaher <akaher@xxxxxxxxxx> Message-ID: <20240206120948.980929088@xxxxxxxxxxxxxxxxxxxxx> From: "Steven Rostedt (Google)" <rostedt@xxxxxxxxxxx> commit f2f496370afcbc5227d7002da28c74b91fed12ff upstream. The eventfs_inode->is_freed was a union with the rcu_head with the assumption that when it was on the srcu list the head would contain a pointer which would make "is_freed" true. But that was a wrong assumption as the rcu head is a single link list where the last element is NULL. Instead, split the nr_entries integer so that "is_freed" is one bit and the nr_entries is the next 31 bits. As there shouldn't be more than 10 (currently there's at most 5 to 7 depending on the config), this should not be a problem. Link: https://lkml.kernel.org/r/20231101172649.049758712@xxxxxxxxxxx Cc: stable@xxxxxxxxxxxxxxx Cc: Mark Rutland <mark.rutland@xxxxxxx> Cc: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> Cc: Ajay Kaher <akaher@xxxxxxxxxx> Fixes: 63940449555e7 ("eventfs: Implement eventfs lookup, read, open functions") Reviewed-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx> Signed-off-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/tracefs/event_inode.c | 2 ++ fs/tracefs/internal.h | 6 +++--- 2 files changed, 5 insertions(+), 3 deletions(-) --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -824,6 +824,8 @@ static void eventfs_remove_rec(struct ev eventfs_remove_rec(ei_child, head, level + 1); } + ei->is_freed = 1; + list_del_rcu(&ei->list); list_add_tail(&ei->del_list, head); } --- a/fs/tracefs/internal.h +++ b/fs/tracefs/internal.h @@ -23,6 +23,7 @@ struct tracefs_inode { * @d_parent: pointer to the parent's dentry * @d_children: The array of dentries to represent the files when created * @data: The private data to pass to the callbacks + * @is_freed: Flag set if the eventfs is on its way to be freed * @nr_entries: The number of items in @entries */ struct eventfs_inode { @@ -38,14 +39,13 @@ struct eventfs_inode { * Union - used for deletion * @del_list: list of eventfs_inode to delete * @rcu: eventfs_inode to delete in RCU - * @is_freed: node is freed if one of the above is set */ union { struct list_head del_list; struct rcu_head rcu; - unsigned long is_freed; }; - int nr_entries; + unsigned int is_freed:1; + unsigned int nr_entries:31; }; static inline struct tracefs_inode *get_tracefs(const struct inode *inode) Patches currently in stable-queue which might be from rostedt@xxxxxxxxxx are queue-6.6/eventfs-keep-all-directory-links-at-1.patch queue-6.6/eventfs-make-sure-that-parent-d_inode-is-locked-in-creating-files-dirs.patch queue-6.6/eventfs-save-directory-inodes-in-the-eventfs_inode-structure.patch queue-6.6/revert-eventfs-save-ownership-and-mode.patch queue-6.6/tracefs-zero-out-the-tracefs_inode-when-allocating-it.patch queue-6.6/eventfs-read-ei-entries-before-ei-children-in-eventfs_iterate.patch queue-6.6/eventfs-do-not-invalidate-dentry-in-create_file-dir_dentry.patch queue-6.6/eventfs-fix-file-and-directory-uid-and-gid-ownership.patch queue-6.6/eventfs-remove-lookup-parameter-from-create_dir-file_dentry.patch queue-6.6/eventfs-use-gfp_nofs-for-allocation-when-eventfs_mutex-is-held.patch queue-6.6/eventfs-remove-fsnotify-functions-from-lookup.patch queue-6.6/eventfs-use-err_cast-in-eventfs_create_events_dir.patch queue-6.6/revert-eventfs-use-simple_recursive_removal-to-clean-up-dentries.patch queue-6.6/eventfs-use-simple_recursive_removal-to-clean-up-dentries.patch queue-6.6/eventfs-stop-using-dcache_readdir-for-getdents.patch queue-6.6/eventfs-have-event-files-and-directories-default-to-parent-uid-and-gid.patch queue-6.6/eventfs-use-eventfs_remove_events_dir.patch queue-6.6/eventfs-delete-eventfs_inode-when-the-last-dentry-is-freed.patch queue-6.6/tracefs-avoid-using-the-ei-dentry-pointer-unnecessarily.patch queue-6.6/tracefs-remove-stale-update_gid-code.patch queue-6.6/eventfs-initialize-the-tracefs-inode-properly.patch queue-6.6/eventfs-remove-special-processing-of-dput-of-events-directory.patch queue-6.6/eventfs-save-ownership-and-mode.patch queue-6.6/tracefs-check-for-dentry-d_inode-exists-in-set_gid.patch queue-6.6/eventfs-do-ctx-pos-update-for-all-iterations-in-eventfs_iterate.patch queue-6.6/tracefs-dentry-lookup-crapectomy.patch queue-6.6/eventfs-move-taking-of-inode_lock-into-dcache_dir_open_wrapper.patch queue-6.6/eventfs-have-a-free_ei-that-just-frees-the-eventfs_inode.patch queue-6.6/revert-eventfs-remove-is_freed-union-with-rcu-head.patch queue-6.6/eventfs-have-the-inodes-all-for-files-and-directories-all-be-the-same.patch queue-6.6/eventfs-use-kcalloc-instead-of-kzalloc.patch queue-6.6/eventfs-test-for-ei-is_freed-when-accessing-ei-dentry.patch queue-6.6/eventfs-fix-bitwise-fields-for-is_events.patch queue-6.6/eventfs-fix-warn_on-in-create_file_dentry.patch queue-6.6/eventfs-fix-events-beyond-name_max-blocking-tasks.patch queue-6.6/eventfs-shortcut-eventfs_iterate-by-skipping-entries-already-read.patch queue-6.6/revert-eventfs-do-not-allow-null-parent-to-eventfs_start_creating.patch queue-6.6/eventfs-do-not-allow-null-parent-to-eventfs_start_creating.patch queue-6.6/eventfs-do-not-create-dentries-nor-inodes-in-iterate_shared.patch queue-6.6/eventfs-have-eventfs_iterate-stop-immediately-if-ei-is_freed-is-set.patch queue-6.6/eventfs-fix-typo-in-eventfs_inode-union-comment.patch queue-6.6/eventfs-remove-expectation-that-ei-is_freed-means-ei-dentry-null.patch queue-6.6/eventfs-restructure-eventfs_inode-structure-to-be-more-condensed.patch queue-6.6/eventfs-warn-if-an-eventfs_inode-is-freed-without-is_freed-being-set.patch queue-6.6/eventfs-get-rid-of-dentry-pointers-without-refcounts.patch queue-6.6/eventfs-remove-unused-d_parent-pointer-field.patch queue-6.6/eventfs-hold-eventfs_mutex-when-calling-callback-functions.patch queue-6.6/eventfs-remove-is_freed-union-with-rcu-head.patch queue-6.6/tracefs-eventfs-modify-mismatched-function-name.patch queue-6.6/eventfs-fix-kerneldoc-of-eventfs_remove_rec.patch queue-6.6/tracefs-eventfs-use-root-and-instance-inodes-as-default-ownership.patch queue-6.6/revert-eventfs-check-for-null-ef-in-eventfs_set_attr.patch queue-6.6/eventfs-fix-failure-path-in-eventfs_create_events_dir.patch queue-6.6/eventfs-clean-up-dentry-ops-and-add-revalidate-function.patch