From: Joseph Qi <[email protected]>
Commit 1b95382da85c ("eventfs: Use children field for rcu head and add
memory barriers") added an early bail out to the ei->children loop:
smp_rmb();
if (ei->is_freed)
return -EINVAL;
Upstream wraps eventfs_iterate() in guard(srcu)(&eventfs_srcu), so that
return still drops the read lock. The 6.12.y backport instead brackets the
function with srcu_read_lock() and a shared "out" label that calls
srcu_read_unlock(), so this path returns while still holding eventfs_srcu
for reading.
The unbalanced reader prevents the grace period from ever completing, so
the call_srcu() callback queued by free_ei() never runs and the
eventfs_inode is leaked. Every readdir that races with removal adds
another reader.
Set ret and jump to "out" like the other bail out paths in this function
do.
Fixes: 1b95382da85c ("eventfs: Use children field for rcu head and add memory
barriers")
Signed-off-by: Joseph Qi <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
(cherry picked from commit 9e899910695944c4ffbcdc6eac65be6485b146b4)
https://virtuozzo.atlassian.net/browse/VSTOR-154529
Feature: fix ms/tracefs
Signed-off-by: Eva Kurchatova <[email protected]>
---
fs/tracefs/event_inode.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index a157b4cf2b30..fbaa64e482e0 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -668,8 +668,10 @@ static int eventfs_iterate(struct file *file, struct
dir_context *ctx)
* Matches the smp_wmb() in free_ei()
*/
smp_rmb();
- if (ei->is_freed)
- return -EINVAL;
+ if (ei->is_freed) {
+ ret = -EINVAL;
+ goto out;
+ }
if (c > 0) {
c--;
--
2.56.0
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
