[PATCH 0/2] Add scope-based cleanup capability to eventfd_ctx

[PATCH 0/2] Add scope-based cleanup capability to eventfd_ctx

[Bence Csokas]

Add __free() support to eventfd and update drm_syncobj to use it as an
example consumer.

A minor discrepancy I encountered is whether to put a semicolon after
DEFINE_FREE(). It seems some in-tree code does, some doesn't. In the end,
I followed the example set in core-api/cleanup.rst, and omitted it.

Signed-off-by: Bence Csokas <bence.csokas@arm.com>
---
Bence Csokas (2):
      eventfd: Add scope-based cleanup capability
      drm/syncobj: Use scope-based cleanup for eventfd_ctx

 drivers/gpu/drm/drm_syncobj.c | 9 ++++-----
 fs/eventfd.c                  | 3 +++
 include/linux/eventfd.h       | 3 +++
 3 files changed, 10 insertions(+), 5 deletions(-)
---
base-commit: 893e11787f78e43b534e252249ac3fff4d1333f8
change-id: 20260826-efd-autofree-766608e8d8aa

Best regards,
--  
Bence Csokas <bence.csokas@arm.com>

[PATCH 1/2] eventfd: Add scope-based cleanup capability

[Bence Csokas]

Allow eventfd_ctx_put() to be used with the RAII-inspired __free() API.

Signed-off-by: Bence Csokas <bence.csokas@arm.com>
---
 fs/eventfd.c            | 3 +++
 include/linux/eventfd.h | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/fs/eventfd.c b/fs/eventfd.c
index 9d33a02757d5..24111a16284f 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -102,6 +102,9 @@ static void eventfd_free(struct kref *kref)
  */
 void eventfd_ctx_put(struct eventfd_ctx *ctx)
 {
+	if (!ctx)
+		return;
+
 	kref_put(&ctx->kref, eventfd_free);
 }
 EXPORT_SYMBOL_GPL(eventfd_ctx_put);
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index e32bee4345fb..689358c2b0ae 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -10,6 +10,7 @@
 #define _LINUX_EVENTFD_H
 
 #include <linux/wait.h>
+#include <linux/cleanup.h>
 #include <linux/err.h>
 #include <linux/percpu-defs.h>
 #include <linux/percpu.h>
@@ -89,5 +90,7 @@ static inline void eventfd_signal(struct eventfd_ctx *ctx)
 	eventfd_signal_mask(ctx, 0);
 }
 
+DEFINE_FREE(eventfd, struct eventfd_ctx *, eventfd_ctx_put(_T))
+
 #endif /* _LINUX_EVENTFD_H */
 

-- 
2.55.0

Re: [PATCH 1/2] eventfd: Add scope-based cleanup capability

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The DEFINE_FREE wrapper for eventfd lacks an IS_ERR_OR_NULL check. When used with eventfd_ctx_fdget() or eventfd_ctx_fileget() (which return ERR_PTR on failure), the cleanup routine will pass the error pointer to eventfd_ctx_put(), bypassing its NULL check and causing a kernel panic when dereferenced.
--

commit f893599e482de1bd276a121a5c34c8f30a6546ce
Author: Bence Csokas <bence.csokas@arm.com>

eventfd: Add scope-based cleanup capability

This commit introduces a scope-based cleanup capability for eventfd contexts,
allowing eventfd_ctx_put() to be used with the RAII-inspired __free() API.

> diff --git a/fs/eventfd.c b/fs/eventfd.c
> index 9d33a02757d52..24111a16284f1 100644
> --- a/fs/eventfd.c
> +++ b/fs/eventfd.c
> @@ -102,6 +102,9 @@ static void eventfd_free(struct kref *kref)
>   */
>  void eventfd_ctx_put(struct eventfd_ctx *ctx)
>  {
> +	if (!ctx)
> +		return;
> +
>  	kref_put(&ctx->kref, eventfd_free);

[Severity: High]
Does this release function adequately protect against error pointers?

It appears to only guard against NULL, so if the __free wrapper invokes this
function with an ERR_PTR, it seems like it will bypass this check and
cause a kernel panic when dereferencing ctx->kref.

>  }
>  EXPORT_SYMBOL_GPL(eventfd_ctx_put);
> diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
> index e32bee4345fb9..689358c2b0ae7 100644
> --- a/include/linux/eventfd.h
> +++ b/include/linux/eventfd.h
[ ... ]
> @@ -89,5 +90,7 @@ static inline void eventfd_signal(struct eventfd_ctx *ctx)
>  	eventfd_signal_mask(ctx, 0);
>  }
>  
> +DEFINE_FREE(eventfd, struct eventfd_ctx *, eventfd_ctx_put(_T))

[Severity: High]
Is this cleanup wrapper safe to use with functions like eventfd_ctx_fdget()
or eventfd_ctx_fileget() that return ERR_PTR on failure?

Because this wrapper lacks an IS_ERR_OR_NULL check, if a getter fails and
returns an ERR_PTR, the early return path will pass the error pointer to
eventfd_ctx_put(), bypassing its NULL check. This seems to violate the
cleanup function compatibility guidelines and could lead to a crash.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909-efd-autofree-v1-0-c6c3c19cc702@arm.com?part=1

[PATCH 2/2] drm/syncobj: Use scope-based cleanup for eventfd_ctx

[Bence Csokas]

Now that eventfd supports __free(), use it in drm_syncobj_eventfd_ioctl().

Signed-off-by: Bence Csokas <bence.csokas@arm.com>
---
 drivers/gpu/drm/drm_syncobj.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
index c23a5de27eff..261d5606e8bd 100644
--- a/drivers/gpu/drm/drm_syncobj.c
+++ b/drivers/gpu/drm/drm_syncobj.c
@@ -1462,9 +1462,9 @@ int
 drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
 			  struct drm_file *file_private)
 {
+	struct eventfd_ctx *ev_fd_ctx __free(eventfd) = NULL;
 	struct drm_syncobj_eventfd *args = data;
 	struct drm_syncobj *syncobj;
-	struct eventfd_ctx *ev_fd_ctx;
 	struct syncobj_eventfd_entry *entry;
 	int ret;
 
@@ -1484,16 +1484,17 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
 	ev_fd_ctx = eventfd_ctx_fdget(args->fd);
 	if (IS_ERR(ev_fd_ctx)) {
 		ret = PTR_ERR(ev_fd_ctx);
+		ev_fd_ctx = NULL;
 		goto err_fdget;
 	}
 
 	entry = kzalloc_obj(*entry);
 	if (!entry) {
 		ret = -ENOMEM;
-		goto err_kzalloc;
+		goto err_fdget;
 	}
 	entry->syncobj = syncobj;
-	entry->ev_fd_ctx = ev_fd_ctx;
+	entry->ev_fd_ctx = no_free_ptr(ev_fd_ctx);
 	entry->point = args->point;
 	entry->flags = args->flags;
 
@@ -1502,8 +1503,6 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
 
 	return 0;
 
-err_kzalloc:
-	eventfd_ctx_put(ev_fd_ctx);
 err_fdget:
 	drm_syncobj_put(syncobj);
 	return ret;

-- 
2.55.0

Re: [PATCH 2/2] drm/syncobj: Use scope-based cleanup for eventfd_ctx

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Mixing goto-based error handling with scope-based cleanup (__free) in the same function.
--

commit 991d574653fb7465f62bf99703d5af0d6fe21920
Author: Bence Csokas <bence.csokas@arm.com>

drm/syncobj: Use scope-based cleanup for eventfd_ctx

This patch modifies drm_syncobj_eventfd_ioctl() to use the scope-based
cleanup helper for eventfd_ctx, removing the explicit put calls.

> diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c
> index c23a5de27effa..261d5606e8bd8 100644
> --- a/drivers/gpu/drm/drm_syncobj.c
> +++ b/drivers/gpu/drm/drm_syncobj.c
> @@ -1462,9 +1462,9 @@ int
>  drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
>  			  struct drm_file *file_private)
>  {
> +	struct eventfd_ctx *ev_fd_ctx __free(eventfd) = NULL;
>  	struct drm_syncobj_eventfd *args = data;
>  	struct drm_syncobj *syncobj;

[ ... ]

> @@ -1502,8 +1503,6 @@ drm_syncobj_eventfd_ioctl(struct drm_device *dev, void *data,
>  
>  	return 0;
>  
> -err_kzalloc:
> -	eventfd_ctx_put(ev_fd_ctx);
>  err_fdget:
>  	drm_syncobj_put(syncobj);
>  	return ret;

[Severity: Medium]
Does this code in drivers/gpu/drm/drm_syncobj.c:drm_syncobj_eventfd_ioctl()
mix goto-based error handling and scope-based cleanup in the same function?

The cleanup subsystem documentation in include/linux/cleanup.h states that for
a given routine, all resources that need a "goto" cleanup should be converted
to scope-based cleanup, or none of them should be. Mixing the two creates
confusing ownership semantics.

Could the syncobj cleanup also be converted to use __free(), or should we
stick to goto-based cleanup for both resources in this function?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260909-efd-autofree-v1-0-c6c3c19cc702@arm.com?part=2