Re: [syzbot] [fs?] possible deadlock in ovl_create_object (2)

["Jörn Engel" <joern@barelysecure.org>]

Hello Miquèl

On Sun, Sep 20, 2026 at 02:52:18PM +0200, Miquel Raynal wrote:
> 
> Not saying this would be a bad move, it would be highly inconsistent
> with the current code base. Every single allocation in the kernel is
> checked. Such a change, without a documented and agreed upon method,
> would lead to dozens fuzzing AIs sending patches to add the "missing"
> check.

If your argument is that such a change would be inappropriate for the
patch in question, I totally agree with you.

I would disagree with an argument of "we should do the wrong thing for
the sake of consistency".  If indeed it is the wrong thing, we should
stop doing it.  Then we can regain consistency by not doing the wrong
thing anywhere.  In other words, consistency is irrelevant.  The only
question should be whether such a change is right or wrong.

There is also the practical consideration that changing the kmalloc
interface will lead to thousands of changes throughout the kernel and
requires a large time commitment from someone.  If nobody volunteers to
be that someone, it might still be better to stick with the status quo
for now.


So making an entirely theoretical "if I were king for a day" kind of
argument, I don't think GFP_KERNEL allocations should have to check for
failure.  Neither should userspace callers to malloc.  An interface that
frequently returns errors is pretty safe, as callers with broken error
handling are quickly detected and fixes.  An interface that almost never
returns errors is dangerous, as broken error handling in callers becomes
common and will eventually lead to bizarre hard-to-reproduce failures.

One of my roles in my last job was to fix userspace malloc and one of my
fixes was to ensure it would never return an allocation failure.  If it
returned, the caller received what it requested.  If that wasn't
possible, the process would crash.  A crashing process isn't exactly
desired, but it beats unpredictable behavior triggered by broken error
handlers.  And dealing with a single error path costs significantly less
cognitive effort than dealing with thousands of error handlers
everywhere in the code base.

Anyway, since I am not volunteering to spend a significant chunk of my
time, this is just the opinion of someone that doesn't matter.  Feel
free to reject it.

Jörn

--
Why do musicians compose symphonies and poets write poems?
They do it because life wouldn't have any meaning for them if they didn't.
That's why I draw cartoons.  It's my life.
-- Charles Shultz