Re: [PATCH] eventfs: Initialise ei->children before it can be freed

[Steven Rostedt]

On Tue, 25 Aug 2026 22:57:18 +0100
David Carlier <devnexen@xxxxxxxxx> wrote:

> eventfs_create_events_dir() runs INIT_LIST_HEAD(&ei->children) only after
> tracefs_get_inode() succeeds, but that call's failure path jumps to "fail",
> which calls cleanup_ei() and then free_ei(). free_ei() reads the list with
> WARN_ON_ONCE(!list_empty(&ei->children)), and alloc_root_ei() uses
> kzalloc(), so children.next is NULL there and the WARN fires.
> 
> The path is reachable at runtime: mkdir /sys/kernel/tracing/instances/foo
> ends up in create_event_toplevel_files() and eventfs_create_events_dir().
> 
> Move both INIT_LIST_HEAD() calls up to right after the allocation.
> 
> Fixes: f0ece16ffca7 ("eventfs: Use children field for rcu head and add memory barriers")
> Signed-off-by: David Carlier <devnexen@xxxxxxxxx>

Already queued by someone else.

https://patch.msgid.link/20260824144653.54044-1-kartikey406@xxxxxxxxx

-- Steve