Commit d81786f5 authored Jan 31, 2024 by Steven Rostedt (Google)

tracefs: Zero out the tracefs_inode when allocating it

eventfs uses the tracefs_inode and assumes that it's already initialized
to zero. That is, it doesn't set fields to zero (like ti->private) after
getting its tracefs_inode. This causes bugs due to stale values.

Just initialize the entire structure to zero on allocation so there isn't
any more surprises.

This is a partial fix to access to ti->private. The assignment still needs
to be made before the dentry is instantiated.

Link: https://lore.kernel.org/linux-trace-kernel/20240131185512.315825944@goodmis.org



Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Al Viro <viro@ZenIV.linux.org.uk>
Cc: Ajay Kaher <ajay.kaher@broadcom.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Fixes: 5790b1fb ("eventfs: Remove eventfs_file and just use eventfs_inode")
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202401291043.e62e89dc-oliver.sang@intel.com


Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>

parent 66bbea9e

fs/tracefs/inode.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -38,8 +38,6 @@ static struct inode tracefs_alloc_inode(struct super_block sb)
		if (!ti)
		return NULL;

		ti->flags = 0;

		return &ti->vfs_inode;
		}

		@@ -779,7 +777,11 @@ static void init_once(void *foo)
		{
		struct tracefs_inode ti = (struct tracefs_inode ) foo;

		/* inode_init_once() calls memset() on the vfs_inode portion */
		inode_init_once(&ti->vfs_inode);

		/* Zero out the rest */
		memset_after(ti, 0, vfs_inode);
		}

		static int __init tracefs_init(void)

fs/tracefs/internal.h

+2 −1

Original line number	Diff line number	Diff line
		@@ -11,9 +11,10 @@ enum {
		};

		struct tracefs_inode {
		struct inode vfs_inode;
		/* The below gets initialized with memset_after(ti, 0, vfs_inode) */
		unsigned long flags;
		void *private;
		struct inode vfs_inode;
		};

		/*