fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   d1f2d51b711a3b7f1ae1b46701c769c1d580fa7f
commit: f89ea63f1c65d3e93b255f14f9d9e05df87955fa netfs, 9p: Fix race between umount and async request completion
date:   3 months ago
config: x86_64-randconfig-102-20240908 (https://download.01.org/0day-ci/archive/20240908/202409082345.wiwtJarb-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409082345.wiwtJarb-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

vim +148 fs/netfs/objects.c

   123	
   124	static void netfs_free_request(struct work_struct *work)
   125	{
   126		struct netfs_io_request *rreq =
   127			container_of(work, struct netfs_io_request, work);
   128		struct netfs_inode *ictx = netfs_inode(rreq->inode);
   129		unsigned int i;
   130	
   131		trace_netfs_rreq(rreq, netfs_rreq_trace_free);
   132		netfs_proc_del_rreq(rreq);
   133		netfs_clear_subrequests(rreq, false);
   134		if (rreq->netfs_ops->free_request)
   135			rreq->netfs_ops->free_request(rreq);
   136		if (rreq->cache_resources.ops)
   137			rreq->cache_resources.ops->end_operation(&rreq->cache_resources);
   138		if (rreq->direct_bv) {
   139			for (i = 0; i < rreq->direct_bv_count; i++) {
   140				if (rreq->direct_bv[i].bv_page) {
   141					if (rreq->direct_bv_unpin)
   142						unpin_user_page(rreq->direct_bv[i].bv_page);
   143				}
   144			}
   145			kvfree(rreq->direct_bv);
   146		}
   147	
 > 148		if (atomic_dec_and_test(&ictx->io_count))
   149			wake_up_var(&ictx->io_count);
 > 150		call_rcu(&rreq->rcu, netfs_free_request_rcu);
   151	}
   152	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

[David Howells]

kernel test robot <lkp@intel.com> wrote:

>  > 148		if (atomic_dec_and_test(&ictx->io_count))
>    149			wake_up_var(&ictx->io_count);
>  > 150		call_rcu(&rreq->rcu, netfs_free_request_rcu);

->io_count isn't a refcount for the rreq struct.  This is not a bug.

David

fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   d8b78066f4c9c8ec898bd4246fc4db31d476dd88
commit: f89ea63f1c65d3e93b255f14f9d9e05df87955fa netfs, 9p: Fix race between umount and async request completion
date:   6 months ago
config: openrisc-randconfig-r061-20241130 (https://download.01.org/0day-ci/archive/20241201/202412010523.B4dXJKXN-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412010523.B4dXJKXN-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> fs/netfs/objects.c:148:5-24: WARNING: atomic_dec_and_test variation before object free at line 150.

vim +148 fs/netfs/objects.c

   123	
   124	static void netfs_free_request(struct work_struct *work)
   125	{
   126		struct netfs_io_request *rreq =
   127			container_of(work, struct netfs_io_request, work);
   128		struct netfs_inode *ictx = netfs_inode(rreq->inode);
   129		unsigned int i;
   130	
   131		trace_netfs_rreq(rreq, netfs_rreq_trace_free);
   132		netfs_proc_del_rreq(rreq);
   133		netfs_clear_subrequests(rreq, false);
   134		if (rreq->netfs_ops->free_request)
   135			rreq->netfs_ops->free_request(rreq);
   136		if (rreq->cache_resources.ops)
   137			rreq->cache_resources.ops->end_operation(&rreq->cache_resources);
   138		if (rreq->direct_bv) {
   139			for (i = 0; i < rreq->direct_bv_count; i++) {
   140				if (rreq->direct_bv[i].bv_page) {
   141					if (rreq->direct_bv_unpin)
   142						unpin_user_page(rreq->direct_bv[i].bv_page);
   143				}
   144			}
   145			kvfree(rreq->direct_bv);
   146		}
   147	
 > 148		if (atomic_dec_and_test(&ictx->io_count))
   149			wake_up_var(&ictx->io_count);
 > 150		call_rcu(&rreq->rcu, netfs_free_request_rcu);
   151	}
   152	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki