[cel:nfsd-testing 295/295] fs/lockd/svcsubs.c:428:5-24: WARNING: atomic_dec_and_test variation before object free at line 429.

[cel:nfsd-testing 295/295] fs/lockd/svcsubs.c:428:5-24: WARNING: atomic_dec_and_test variation before object free at line 429.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/cel/linux nfsd-testing
head:   56589cdb58819ce54decedbbfddf231d94b5ce41
commit: 56589cdb58819ce54decedbbfddf231d94b5ce41 [295/295] lockd: make the nlm_file reference count atomic
config: x86_64-randconfig-2101-20261005 (https://download.01.org/0day-ci/archive/20261005/202610052357.ZfzEOheQ-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202610052357.ZfzEOheQ-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> fs/lockd/svcsubs.c:428:5-24: WARNING: atomic_dec_and_test variation before object free at line 429.

vim +428 fs/lockd/svcsubs.c

   408	
   409	/*
   410	 * Release file. If there are no more remote locks on this file,
   411	 * close it and free the handle.
   412	 *
   413	 * Note that we can't do proper reference counting without major
   414	 * contortions because the code in fs/locks.c creates, deletes and
   415	 * splits locks without notification. Our only way is to walk the
   416	 * entire lock list each time we remove a lock.
   417	 */
   418	void
   419	nlm_release_file(struct nlm_file *file)
   420	{
   421		dprintk("lockd: nlm_release_file(%p, ct = %d)\n",
   422					file, atomic_read(&file->f_count));
   423	
   424		/* Lock file table */
   425		mutex_lock(&nlm_file_mutex);
   426	
   427		/* If there are no more locks etc, delete the file */
 > 428		if (atomic_dec_and_test(&file->f_count) && !nlm_file_inuse(file))
 > 429			nlm_delete_file(file);
   430	
   431		mutex_unlock(&nlm_file_mutex);
   432	}
   433	

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [cel:nfsd-testing 295/295] fs/lockd/svcsubs.c:428:5-24: WARNING: atomic_dec_and_test variation before object free at line 429.

[Benjamin Coddington]

From: Benjamin Coddington <bcodding@hammerspace.com>

On 5 Oct 2026, at 18:00, kernel test robot wrote:

> cocci warnings: (new ones prefixed by >>)
>>> fs/lockd/svcsubs.c:428:5-24: WARNING: atomic_dec_and_test variation before object free at line 429.

This is atomic_as_refcounter.cocci suggesting refcount_t, which doesn't
fit f_count.  The count rests at zero while locks hold the nlm_file in
the table, and nlm_lookup_file() and nlm_traverse_files() increment it
from zero, which refcount_t would WARN on.  Whether to free is decided by
nlm_file_inuse() under nlm_file_mutex, not by the decrement.  The commit
message notes why it is an atomic_t rather than a refcount_t.

No change planned.

Ben