[block:for-5.13/io_uring 100/106] fs/io_uring.c:7129:6-25: atomic_dec_and_test variation before object free at line 7131.

[block:for-5.13/io_uring 100/106] fs/io_uring.c:7129:6-25: atomic_dec_and_test variation before object free at line 7131.

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3789 bytes --]

CC: kbuild-all(a)lists.01.org
TO: Pavel Begunkov <asml.silence@gmail.com>
CC: Jens Axboe <axboe@kernel.dk>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-5.13/io_uring
head:   cad640129f844fcb72750f4cced5041ead287cbe
commit: 02d8c7c9268a37bd413346482122a85f2315d443 [100/106] io_uring: simplify io_rsrc_data refcounting
:::::: branch date: 4 hours ago
:::::: commit date: 4 hours ago
config: i386-allyesconfig (attached as .config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Julia Lawall <julia.lawall@lip6.fr>


cocci warnings: (new ones prefixed by >>)
>> fs/io_uring.c:7129:6-25: atomic_dec_and_test variation before object free at line 7131.

vim +7129 fs/io_uring.c

89a022d156fc5b Pavel Begunkov   2021-03-19  7112  
f447356ebb0a2b Pavel Begunkov   2021-04-01  7113  static int io_rsrc_ref_quiesce(struct io_rsrc_data *data, struct io_ring_ctx *ctx)
8bad28d8a305b0 Hao Xu           2021-02-19  7114  {
8bad28d8a305b0 Hao Xu           2021-02-19  7115  	int ret;
0558955373023b Xiaoguang Wang   2020-03-31  7116  
ce3aa60df20600 Pavel Begunkov   2021-04-01  7117  	/* As we may drop ->uring_lock, other task may have started quiesce */
8bad28d8a305b0 Hao Xu           2021-02-19  7118  	if (data->quiesce)
8bad28d8a305b0 Hao Xu           2021-02-19  7119  		return -ENXIO;
8bad28d8a305b0 Hao Xu           2021-02-19  7120  
8bad28d8a305b0 Hao Xu           2021-02-19  7121  	data->quiesce = true;
1ffc54220c4447 Pavel Begunkov   2020-12-30  7122  	do {
2df8cab256ad1a Pavel Begunkov   2021-04-01  7123  		ret = io_rsrc_node_switch_start(ctx);
89a022d156fc5b Pavel Begunkov   2021-03-19  7124  		if (ret)
f2303b1f8244d8 Pavel Begunkov   2021-02-20  7125  			break;
2df8cab256ad1a Pavel Begunkov   2021-04-01  7126  		io_rsrc_node_switch(ctx, data);
2df8cab256ad1a Pavel Begunkov   2021-04-01  7127  
02d8c7c9268a37 Pavel Begunkov   2021-04-11  7128  		/* kill initial ref, already quiesced if zero */
02d8c7c9268a37 Pavel Begunkov   2021-04-11 @7129  		if (atomic_dec_and_test(&data->refs))
02d8c7c9268a37 Pavel Begunkov   2021-04-11  7130  			break;
8bad28d8a305b0 Hao Xu           2021-02-19 @7131  		flush_delayed_work(&ctx->rsrc_put_work);
1ffc54220c4447 Pavel Begunkov   2020-12-30  7132  		ret = wait_for_completion_interruptible(&data->done);
1ffc54220c4447 Pavel Begunkov   2020-12-30  7133  		if (!ret)
1ffc54220c4447 Pavel Begunkov   2020-12-30  7134  			break;
8bad28d8a305b0 Hao Xu           2021-02-19  7135  
02d8c7c9268a37 Pavel Begunkov   2021-04-11  7136  		atomic_inc(&data->refs);
02d8c7c9268a37 Pavel Begunkov   2021-04-11  7137  		/* wait for all works potentially completing data->done */
02d8c7c9268a37 Pavel Begunkov   2021-04-11  7138  		flush_delayed_work(&ctx->rsrc_put_work);
cb5e1b81304e08 Jens Axboe       2021-02-25  7139  		reinit_completion(&data->done);
89a022d156fc5b Pavel Begunkov   2021-03-19  7140  
8bad28d8a305b0 Hao Xu           2021-02-19  7141  		mutex_unlock(&ctx->uring_lock);
8bad28d8a305b0 Hao Xu           2021-02-19  7142  		ret = io_run_task_work_sig();
8bad28d8a305b0 Hao Xu           2021-02-19  7143  		mutex_lock(&ctx->uring_lock);
f2303b1f8244d8 Pavel Begunkov   2021-02-20  7144  	} while (ret >= 0);
8bad28d8a305b0 Hao Xu           2021-02-19  7145  	data->quiesce = false;
05f3fb3c539752 Jens Axboe       2019-12-09  7146  
8bad28d8a305b0 Hao Xu           2021-02-19  7147  	return ret;
d7954b2ba94639 Bijan Mottahedeh 2021-01-15  7148  }
d7954b2ba94639 Bijan Mottahedeh 2021-01-15  7149  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 65051 bytes --]