AZL-88953

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Hold eventfs_mutex and SRCU when remount walks events

Commit 340f0c7067a9 ("eventfs: Update all the eventfsinodes from the events descriptor") had eventfssetattrs() recurse through ei->children on remount. The walk only holds the rcureadlock() taken by tracefsapplyoptions() over tracefsinodes, which is wrong:

• listforeachentry over ei->children races with the listdelrcu() in eventfsremoverec() -- LISTPOISON1 deref, same shape as d2603279c7d6.
• eventfsinodes are freed via callsrcu(&eventfssrcu, ...). rcuread_lock() does not extend an SRCU grace period, so ti->private can be reclaimed under the walk.
• The writes to ei->attr race with eventfssetattr(), which holds eventfs_mutex.

Reproducer:

while :; do mount -o remount,uid=$((RANDOM%1000)) /sys/kernel/tracing; done & while :; do echo "p:kp submitbio" > /sys/kernel/tracing/kprobeevents echo > /sys/kernel/tracing/kprobe_events done

Wrap the events portion of tracefsapplyoptions() in eventfsremountlock()/unlock() that take eventfsmutex and srcureadlock(&eventfssrcu). eventfssetattrs() doesn't sleep so the nested rcureadlock() is fine; lockdepassert_held() pins the contract.

Comment in tracefsdropinode() said "RCU cycle" -- it is SRCU.