[openeuler:openEuler-1.0-LTS 1291/1291] drivers/char/svm.c:312:17-38: WARNING: atomic_dec_and_test variation before object free at line 335.

[kernel test robot <lkp@intel.com>]

tree:   https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS
head:   a81d020c58c2c6a55ebaf15846470a9ecb69bd1a
commit: 4cdb60f56180d6ef7c10bd0e50ddda96ebc9f783 [1291/1291] svm: implement unpin pages to dec refcount
config: arm64-randconfig-r063-20241113 (https://download.01.org/0day-ci/archive/20241113/202411132134.HfBsR3KA-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411132134.HfBsR3KA-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> drivers/char/svm.c:312:17-38: WARNING: atomic_dec_and_test variation before object free at line 335.

vim +312 drivers/char/svm.c

   304	
   305	static void svm_remove_sdma(struct svm_process *process,
   306				    struct svm_sdma *sdma, bool try_rm)
   307	{
   308		int null_count = 0;
   309	
   310		mutex_lock(&process->mutex);
   311	
 > 312		if (try_rm && (!atomic64_dec_and_test(&sdma->ref))) {
   313			mutex_unlock(&process->mutex);
   314			return;
   315		}
   316	
   317		rb_erase(&sdma->node, &process->sdma_list);
   318		RB_CLEAR_NODE(&sdma->node);
   319		mutex_unlock(&process->mutex);
   320	
   321		while (sdma->nr_pages--) {
   322			if (sdma->pages[sdma->nr_pages] == NULL) {
   323				pr_err("null pointer, nr_pages:%d.\n", sdma->nr_pages);
   324				null_count++;
   325				continue;
   326			}
   327	
   328			put_page(sdma->pages[sdma->nr_pages]);
   329		}
   330	
   331		if (null_count)
   332			dump_stack();
   333	
   334		kfree(sdma->pages);
 > 335		kfree(sdma);
   336	}
   337	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki