CVE-2026-99173: eventfs: Free the eventfs_inode after an rcu grace period too

In the Linux kernel, the following vulnerability has been resolved:

eventfs: Free the eventfsinode after an rcu grace period too

tracefsdrevalidate() reads ->isfreed of the eventfsinode that dentry->dfsdata points to, and ->drevalidate() is called in rcu pathwalk mode with nothing but rcureadlock() held. The dentry itself stays around for such a walker, but tracefsdrelease() drops its reference to the eventfsinode when the dentry is killed, and releaseei() then frees it after a grace period of eventfssrcu. An SRCU grace period doesn't wait for rcureadlock() sections, so the walker can read an eventfsinode that is already gone.

With a pathwalk held up in tracefsdrevalidate() while the dentry goes away:

BUG: KASAN: slab-use-after-free in tracefsdrevalidate+0x76/0x90 Read of size 1 at addr ff1100010152d8d0 by task walker/97 Call Trace: <TASK> tracefsdrevalidate+0x76/0x90 lookupfast+0x320/0x640 pathlookupat+0x160/0xb00 filenamelookup+0x1f1/0x5b0 vfsstatx+0xd7/0x3b0 vfsfstatat+0x4d/0x90 dosysnewfstatat+0xa0/0x100 dosyscall64+0x10e/0x5e0 entrySYSCALL64afterhwframe+0x77/0x7f [...] Allocated by task 1: kmalloccachenoprof+0x249/0x560 eventfscreatedir+0x7a/0x590 eventcreatedir+0x2fb/0xcf0 traceaddeventcall+0xbf/0x150 [...] Freed by task 11: kfree+0x1db/0x5b0 srcuinvokecallbacks+0x3a3/0x620 processonework+0x937/0x1810 workerthread+0x4f1/0xd60

Before commit 8e556432477e ("eventfs: Use SRCU for freeing eventfsinodes") releaseei() used callrcu(), which covered the walker, while eventfsiterate() needs the SRCU grace period. Wait for both and chain callrcu() from the SRCU callback.