Re: [PATCH] eventfs: Initialize ei->children and ei->list in init_ei()

On Mon, 24 Aug 2026 20:16:53 +0530
Deepanshu Kartikey <[email protected]> wrote:

Yeah, I saw the syzbot report and came up immediately with this fix as
well. But the change log is way too verbose for such a simple fix. Did
you use AI for this patch? If so, you must divulge that information,
usually with a tag.

> eventfs_create_events_dir() allocates the eventfs_inode via
> alloc_root_ei(), but only calls INIT_LIST_HEAD() on ei->children
> and ei->list after the tracefs_get_inode() check. If that check
> fails, the code jumps to the fail label and calls cleanup_ei(),
> which calls free_ei():
> 
> 	WARN_ON_ONCE(!list_empty(&ei->children));
> 
> Since ei was allocated with kzalloc(), ei->children.next is NULL
> at this point, not a self-referencing pointer. list_empty() checks
> head->next == head, so it returns false on an uninitialized list
> head, triggering a false-positive WARN_ON_ONCE() even though the
> list was never used.
> 
> eventfs_create_dir() has the same latent issue: alloc_ei() is
> called before INIT_LIST_HEAD(), leaving a window where an early
> failure path could hit cleanup_ei() on an uninitialized list head.
> 
> Move the INIT_LIST_HEAD() calls into init_ei(), which is called
> by both alloc_ei() and alloc_root_ei() immediately after
> allocation. This guarantees every eventfs_inode has a valid,
> self-linked, empty children/list the moment it is allocated,
> regardless of which failure path runs afterward.

The change log only needs to say:

  eventfs_create_dir() allocates the eventfs_inode and initializes it
  with init_ei(). But this does not initialize the eventfs_inode
  list_heads. If the eventfs_create_dir() fails due to memory pressure,
  it will call free_ei() which checks to make sure the eventfs_inode
  has no children. But because the list wasn't initialized, it will
  give a false warning.

  Fix it by moving the list initialization into init_ei().

See, much better. Right to the point without all the AI slop.

I'll take your patch, but I'm replacing the commit log with the above.

-- Steve


> 
> Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_inode")
> Reported-by: [email protected]
> Closes: https://syzkaller.appspot.com/bug?extid=3ef80b4ed02226d04a06
> Cc: [email protected]
> Signed-off-by: Deepanshu Kartikey <[email protected]>
> ---
>  fs/tracefs/event_inode.c | 7 ++-----
>  1 file changed, 2 insertions(+), 5 deletions(-)
> 
> diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
> index 604ba3e841d2..6e3513b13cfa 100644
> --- a/fs/tracefs/event_inode.c
> +++ b/fs/tracefs/event_inode.c
> @@ -438,6 +438,8 @@ static inline struct eventfs_inode *init_ei(struct eventfs_inode *ei, const char
>  	if (!ei->name)
>  		return NULL;
>  	kref_init(&ei->kref);
> +	INIT_LIST_HEAD(&ei->children);
> +	INIT_LIST_HEAD(&ei->list);
>  	return ei;
>  }
>  
> @@ -729,8 +731,6 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
>  	ei->entries = entries;
>  	ei->nr_entries = size;
>  	ei->data = data;
> -	INIT_LIST_HEAD(&ei->children);
> -	INIT_LIST_HEAD(&ei->list);
>  
>  	scoped_guard(mutex, &eventfs_mutex) {
>  		if (!parent->is_freed)
> @@ -802,9 +802,6 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
>  	ei->attr.uid = uid;
>  	ei->attr.gid = gid;
>  
> -	INIT_LIST_HEAD(&ei->children);
> -	INIT_LIST_HEAD(&ei->list);
> -
>  	ti = get_tracefs(inode);
>  	ti->flags |= TRACEFS_EVENT_INODE;
>  	ti->private = ei;