6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Joseph Qi Commit 2b80707b9e27 ("eventfs: Use children field for rcu head and add memory barriers") added an early bail out to the ei->children loop: smp_rmb(); if (ei->is_freed) return -EINVAL; Upstream wraps eventfs_iterate() in guard(srcu)(&eventfs_srcu), so that return still drops the read lock. The 6.18.y backport instead brackets the function with srcu_read_lock() and a shared "out" label that calls srcu_read_unlock(), so this path returns while still holding eventfs_srcu for reading. The unbalanced reader prevents the grace period from ever completing, so the call_srcu() callback queued by free_ei() never runs and the eventfs_inode is leaked. Every readdir that races with removal adds another reader. Set ret and jump to "out" like the other bail out paths in this function do. Fixes: 2b80707b9e27 ("eventfs: Use children field for rcu head and add memory barriers") Signed-off-by: Joseph Qi Signed-off-by: Sasha Levin --- fs/tracefs/event_inode.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index a992c2919f79a..e060dfe7cdac5 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -678,8 +678,10 @@ static int eventfs_iterate(struct file *file, struct dir_context *ctx) * Matches the smp_wmb() in free_ei() */ smp_rmb(); - if (ei->is_freed) - return -EINVAL; + if (ei->is_freed) { + ret = -EINVAL; + goto out; + } if (c > 0) { c--; -- 2.53.0