[axboe-block:for-6.15/block 75/76] drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

[kernel test robot <lkp@intel.com>]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-6.15/block
head:   4c3f4bad7a6e9022489a9f8392f7147ed3ce74b1
commit: dfc77a934a3acdb13dadf237b7417c6a31b19da8 [75/76] loop: try to handle loop aio command via NOWAIT IO first
config: i386-randconfig-052-20250323 (https://download.01.org/0day-ci/archive/20250324/202503240625.LfSMQqA2-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202503240625.LfSMQqA2-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

vim +388 drivers/block/loop.c

bc07c10a3603a5 Ming Lei          2015-08-17  383  
92d773324b7edb Shaohua Li        2017-09-01  384  static void lo_rw_aio_do_completion(struct loop_cmd *cmd)
92d773324b7edb Shaohua Li        2017-09-01  385  {
1894e916546df0 Jens Axboe        2018-04-13  386  	struct request *rq = blk_mq_rq_from_pdu(cmd);
1894e916546df0 Jens Axboe        2018-04-13  387  
92d773324b7edb Shaohua Li        2017-09-01 @388  	if (!atomic_dec_and_test(&cmd->ref))
92d773324b7edb Shaohua Li        2017-09-01  389  		return;
dfc77a934a3acd Ming Lei          2025-03-22  390  
dfc77a934a3acd Ming Lei          2025-03-22  391  	/* -EAGAIN could be returned from bdev's ->ki_complete */
dfc77a934a3acd Ming Lei          2025-03-22  392  	if (cmd->ret == -EAGAIN) {
dfc77a934a3acd Ming Lei          2025-03-22  393  		struct loop_device *lo = rq->q->queuedata;
dfc77a934a3acd Ming Lei          2025-03-22  394  
dfc77a934a3acd Ming Lei          2025-03-22 @395  		loop_queue_work(lo, cmd);
dfc77a934a3acd Ming Lei          2025-03-22  396  		return;
dfc77a934a3acd Ming Lei          2025-03-22  397  	}
dfc77a934a3acd Ming Lei          2025-03-22  398  
92d773324b7edb Shaohua Li        2017-09-01  399  	kfree(cmd->bvec);
15f73f5b3e5958 Christoph Hellwig 2020-06-11  400  	if (likely(!blk_should_fake_timeout(rq->q)))
1894e916546df0 Jens Axboe        2018-04-13  401  		blk_mq_complete_request(rq);
92d773324b7edb Shaohua Li        2017-09-01  402  }
92d773324b7edb Shaohua Li        2017-09-01  403  

:::::: The code at line 388 was first introduced by commit
:::::: 92d773324b7edbd36bf0c28c1e0157763aeccc92 block/loop: fix use after free

:::::: TO: Shaohua Li <shli@fb.com>
:::::: CC: Jens Axboe <axboe@kernel.dk>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki