Shuangpeng Bai b77581b25e eventfs: Fix use-after-free in eventfs_remove_rec() ...

commit fd73b69170 upstream.

eventfs_remove_rec() recursively removes the child at the current loop
position. After the recursive call returns, list_for_each_entry() advances
by reading list.next from the removed child.

If free_ei() drops the final reference, release_ei() reuses the list/rcu
union to queue an SRCU callback. The child may be freed before that read.
The eventfs_mutex serializes list updates, but it does not keep the removed
child alive or prevent the SRCU callback from running.

Use list_for_each_entry_safe() to save the next sibling before recursively
removing the current child.

Cc: stable@vger.kernel.org
Fixes: 43aa6f97c2 ("eventfs: Get rid of dentry pointers without refcounts")
Link: https://patch.msgid.link/20260806022719.375354-1-shuangpeng.kernel@gmail.com
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-08-19 18:13:13 +02:00

..

event_inode.c

eventfs: Fix use-after-free in eventfs_remove_rec()

2026-08-19 18:13:13 +02:00

inode.c

eventfs: Hold eventfs_mutex and SRCU when remount walks events

2026-05-17 17:13:41 +02:00

internal.h

eventfs: Hold eventfs_mutex and SRCU when remount walks events

2026-05-17 17:13:41 +02:00

Makefile

…