Re: [PATCH 1/2] eventfd: Add scope-based cleanup capability

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The DEFINE_FREE wrapper for eventfd lacks an IS_ERR_OR_NULL check. When used with eventfd_ctx_fdget() or eventfd_ctx_fileget() (which return ERR_PTR on failure), the cleanup routine will pass the error pointer to eventfd_ctx_put(), bypassing its NULL check and causing a kernel panic when dereferenced.
--

commit f893599e482de1bd276a121a5c34c8f30a6546ce
Author: Bence Csokas <bence.csokas@arm.com>

eventfd: Add scope-based cleanup capability

This commit introduces a scope-based cleanup capability for eventfd contexts,
allowing eventfd_ctx_put() to be used with the RAII-inspired __free() API.

> diff --git a/fs/eventfd.c b/fs/eventfd.c
> index 9d33a02757d52..24111a16284f1 100644
> --- a/fs/eventfd.c
> +++ b/fs/eventfd.c
> @@ -102,6 +102,9 @@ static void eventfd_free(struct kref *kref)
>   */
>  void eventfd_ctx_put(struct eventfd_ctx *ctx)
>  {
> +	if (!ctx)
> +		return;
> +
>  	kref_put(&ctx->kref, eventfd_free);

[Severity: High]
Does this release function adequately protect against error pointers?

It appears to only guard against NULL, so if the __free wrapper invokes this
function with an ERR_PTR, it seems like it will bypass this check and
cause a kernel panic when dereferencing ctx->kref.

>  }
>  EXPORT_SYMBOL_GPL(eventfd_ctx_put);
> diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
> index e32bee4345fb9..689358c2b0ae7 100644
> --- a/include/linux/eventfd.h
> +++ b/include/linux/eventfd.h
[ ... ]
> @@ -89,5 +90,7 @@ static inline void eventfd_signal(struct eventfd_ctx *ctx)
>  	eventfd_signal_mask(ctx, 0);
>  }
>  
> +DEFINE_FREE(eventfd, struct eventfd_ctx *, eventfd_ctx_put(_T))

[Severity: High]
Is this cleanup wrapper safe to use with functions like eventfd_ctx_fdget()
or eventfd_ctx_fileget() that return ERR_PTR on failure?

Because this wrapper lacks an IS_ERR_OR_NULL check, if a getter fails and
returns an ERR_PTR, the early return path will pass the error pointer to
eventfd_ctx_put(), bypassing its NULL check. This seems to violate the
cleanup function compatibility guidelines and could lead to a crash.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909-efd-autofree-v1-0-c6c3c19cc702@arm.com?part=1