* [PATCH] kernfs: recheck of->released after acquiring the active reference
@ 2026-08-20 2:18 Fan Wu
2026-08-20 17:46 ` Tejun Heo
0 siblings, 1 reply; 6+ messages in thread
From: Fan Wu @ 2026-08-20 2:18 UTC (permalink / raw)
To: gregkh, tj; +Cc: chenridong, driver-core, linux-kernel, Fan Wu, stable
kernfs_get_active_of(), added by commit 3c9ba2777d6c ("kernfs: Fix UAF
in polling when open file is released"), tests @of->released before
acquiring the active reference on @of->kn. A hide/drain/show cycle can
run between those steps: the drain path releases the open file, and the
reactivation lets kernfs_get_active() succeed again. Any entry guarded
by kernfs_get_active_of() can consequently run its file operation on an
already released open file; on the cgroup pressure files, the poll
callback dereferences of->priv while forming &ctx->psi.trigger and can
hit either stale, freed memory or NULL.
CPU 0 (kernfs_fop_poll) CPU 1 (echo 0/1 > cgroup.pressure)
------------------------- ---------------------------------
of->released == false kernfs_show(kn, false)
... preempted ... kernfs_drain()
kernfs_release_file()
->release(of) (frees of->priv)
of->released = true
kernfs_show(kn, true)
kernfs_activate_one(kn)
kernfs_get_active(of->kn)
ops->poll(of)
The cycle needs the file operation to be delayed between the two
steps, but kernfs_show() cycles like the one above are fully
userspace driven.
Acquire the active reference first and re-check @of->released under
kernfs_open_file_mutex. While the reference is held, @kn cannot be
drained: kernfs_drain() waits for kn->active to reach
KN_DEACTIVATED_BIAS before draining open files, and the only other
kernfs_release_file() caller, kernfs_fop_release(), is serialized
against in-flight file operations by the VFS. Since
kernfs_release_file() sets @of->released under the same mutex, a
false re-read settles the question for good.
This issue was found by an in-house static analysis tool.
Fixes: 3c9ba2777d6c ("kernfs: Fix UAF in polling when open file is released")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
fs/kernfs/file.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 9adf36e6364b..561f66e4095a 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -73,12 +73,22 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of)
/* Get active reference to kernfs node for an open file */
static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)
{
- /* Skip if file was already released */
- if (unlikely(of->released))
+ if (!kernfs_get_active(of->kn))
return NULL;
- if (!kernfs_get_active(of->kn))
+ /*
+ * @of->released is set under kernfs_open_file_mutex. While the
+ * active reference is held, @kn can't be drained anymore and
+ * kernfs_fop_release() can't run, so re-reading @of->released
+ * here settles whether @of was released for good.
+ */
+ mutex_lock(kernfs_open_file_mutex_ptr(of->kn));
+ if (unlikely(of->released)) {
+ mutex_unlock(kernfs_open_file_mutex_ptr(of->kn));
+ kernfs_put_active(of->kn);
return NULL;
+ }
+ mutex_unlock(kernfs_open_file_mutex_ptr(of->kn));
return of;
}
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] kernfs: recheck of->released after acquiring the active reference
2026-08-20 2:18 [PATCH] kernfs: recheck of->released after acquiring the active reference Fan Wu
@ 2026-08-20 17:46 ` Tejun Heo
2026-08-21 5:07 ` [PATCH v2] " Fan Wu
0 siblings, 1 reply; 6+ messages in thread
From: Tejun Heo @ 2026-08-20 17:46 UTC (permalink / raw)
To: Fan Wu; +Cc: gregkh, chenridong, driver-core, linux-kernel, stable
Hello,
On Thu, Aug 20, 2026 at 02:18:10AM +0000, Fan Wu wrote:
> @@ -73,12 +73,22 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of)
> /* Get active reference to kernfs node for an open file */
> static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)
> {
> - /* Skip if file was already released */
> - if (unlikely(of->released))
> + if (!kernfs_get_active(of->kn))
> return NULL;
>
> - if (!kernfs_get_active(of->kn))
> + /*
> + * @of->released is set under kernfs_open_file_mutex. While the
> + * active reference is held, @kn can't be drained anymore and
> + * kernfs_fop_release() can't run, so re-reading @of->released
> + * here settles whether @of was released for good.
> + */
> + mutex_lock(kernfs_open_file_mutex_ptr(of->kn));
> + if (unlikely(of->released)) {
> + mutex_unlock(kernfs_open_file_mutex_ptr(of->kn));
> + kernfs_put_active(of->kn);
> return NULL;
> + }
> + mutex_unlock(kernfs_open_file_mutex_ptr(of->kn));
"lock -> test something -> unlock" pattern is usually unnecessary. What's
the mutex achieving doing? Doesn't kernfs_get_active() already have strong
enough memory barrier? If not, it'd be better to solve it by iterlocking
kernfs_get_active() and released clearing.
Thanks.
--
tejun
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] kernfs: recheck of->released after acquiring the active reference
2026-08-20 17:46 ` Tejun Heo
@ 2026-08-21 5:07 ` Fan Wu
2026-08-21 19:21 ` Tejun Heo
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Fan Wu @ 2026-08-21 5:07 UTC (permalink / raw)
To: gregkh, tj; +Cc: chenridong, driver-core, linux-kernel, Fan Wu, stable
kernfs_get_active_of(), added by commit 3c9ba2777d6c ("kernfs: Fix UAF
in polling when open file is released"), tests @of->released before
acquiring the active reference on @of->kn. A hide/drain/show cycle can
run between those steps: the drain path releases the open file, and the
reactivation lets kernfs_get_active() succeed again. Any entry guarded
by kernfs_get_active_of() can consequently run its file operation on an
already released open file; on the cgroup pressure files, the poll
callback dereferences of->priv while forming &ctx->psi.trigger and can
hit either stale, freed memory or NULL.
CPU 0 (kernfs_fop_poll) CPU 1 (echo 0/1 > cgroup.pressure)
------------------------- ---------------------------------
of->released == false kernfs_show(kn, false)
... preempted ... kernfs_drain()
kernfs_release_file()
->release(of) (frees of->priv)
of->released = true
kernfs_show(kn, true)
kernfs_activate_one(kn)
kernfs_get_active(of->kn)
ops->poll(of)
The cycle needs the file operation to be delayed between the two
steps, but kernfs_show() cycles like the one above are fully
userspace driven.
Acquire the active reference first and re-check @of->released after
it. While the reference is held, @kn cannot be drained: kernfs_drain()
waits for kn->active to reach KN_DEACTIVATED_BIAS before draining open
files, and the only other kernfs_release_file() caller,
kernfs_fop_release(), is serialized against in-flight file operations
by the VFS, so the re-read settles whether @of was released for good.
The re-check needs no lock: @of->released is only ever set to true,
the drain which sets it precedes the reactivation under kernfs_rwsem,
and the fully-ordered RMW on @kn->active in kernfs_get_active() then
orders the read after that reactivation.
This issue was found by an in-house static analysis tool.
Fixes: 3c9ba2777d6c ("kernfs: Fix UAF in polling when open file is released")
Cc: stable@vger.kernel.org
Suggested-by: Tejun Heo <tj@kernel.org>
Assisted-by: Codex:gpt-5.6
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
Changes since v1:
- Drop the kernfs_open_file_mutex re-check; the fully-ordered RMW in
kernfs_get_active() together with the kernfs_rwsem serialization of
drain and reactivation already orders the released re-read.
- Read @of->released with READ_ONCE().
---
fs/kernfs/file.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c
index 9adf36e6364b..44d40d9e6dd1 100644
--- a/fs/kernfs/file.c
+++ b/fs/kernfs/file.c
@@ -73,12 +73,17 @@ static struct kernfs_open_node *of_on(struct kernfs_open_file *of)
/* Get active reference to kernfs node for an open file */
static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)
{
- /* Skip if file was already released */
- if (unlikely(of->released))
+ if (!kernfs_get_active(of->kn))
return NULL;
- if (!kernfs_get_active(of->kn))
+ /*
+ * A successful active reference prevents a new drain and orders this
+ * check after an earlier reactivation.
+ */
+ if (unlikely(READ_ONCE(of->released))) {
+ kernfs_put_active(of->kn);
return NULL;
+ }
return of;
}
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] kernfs: recheck of->released after acquiring the active reference
2026-08-21 5:07 ` [PATCH v2] " Fan Wu
@ 2026-08-21 19:21 ` Tejun Heo
2026-08-23 12:27 ` kernel test robot
2026-08-23 12:27 ` kernel test robot
2 siblings, 0 replies; 6+ messages in thread
From: Tejun Heo @ 2026-08-21 19:21 UTC (permalink / raw)
To: Fan Wu; +Cc: gregkh, chenridong, driver-core, linux-kernel, stable
On Fri, Aug 21, 2026 at 05:07:20AM +0000, Fan Wu wrote:
> kernfs_get_active_of(), added by commit 3c9ba2777d6c ("kernfs: Fix UAF
> in polling when open file is released"), tests @of->released before
> acquiring the active reference on @of->kn. A hide/drain/show cycle can
> run between those steps: the drain path releases the open file, and the
> reactivation lets kernfs_get_active() succeed again. Any entry guarded
> by kernfs_get_active_of() can consequently run its file operation on an
> already released open file; on the cgroup pressure files, the poll
> callback dereferences of->priv while forming &ctx->psi.trigger and can
> hit either stale, freed memory or NULL.
>
> CPU 0 (kernfs_fop_poll) CPU 1 (echo 0/1 > cgroup.pressure)
> ------------------------- ---------------------------------
> of->released == false kernfs_show(kn, false)
> ... preempted ... kernfs_drain()
> kernfs_release_file()
> ->release(of) (frees of->priv)
> of->released = true
> kernfs_show(kn, true)
> kernfs_activate_one(kn)
> kernfs_get_active(of->kn)
> ops->poll(of)
>
> The cycle needs the file operation to be delayed between the two
> steps, but kernfs_show() cycles like the one above are fully
> userspace driven.
>
> Acquire the active reference first and re-check @of->released after
> it. While the reference is held, @kn cannot be drained: kernfs_drain()
> waits for kn->active to reach KN_DEACTIVATED_BIAS before draining open
> files, and the only other kernfs_release_file() caller,
> kernfs_fop_release(), is serialized against in-flight file operations
> by the VFS, so the re-read settles whether @of was released for good.
> The re-check needs no lock: @of->released is only ever set to true,
> the drain which sets it precedes the reactivation under kernfs_rwsem,
> and the fully-ordered RMW on @kn->active in kernfs_get_active() then
> orders the read after that reactivation.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: 3c9ba2777d6c ("kernfs: Fix UAF in polling when open file is released")
> Cc: stable@vger.kernel.org
> Suggested-by: Tejun Heo <tj@kernel.org>
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
Acked-by: Tejun Heo <tj@kernel.org>
Thanks.
--
tejun
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] kernfs: recheck of->released after acquiring the active reference
2026-08-21 5:07 ` [PATCH v2] " Fan Wu
2026-08-21 19:21 ` Tejun Heo
@ 2026-08-23 12:27 ` kernel test robot
2026-08-23 12:27 ` kernel test robot
2 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-08-23 12:27 UTC (permalink / raw)
To: Fan Wu, gregkh, tj
Cc: oe-kbuild-all, chenridong, driver-core, linux-kernel, Fan Wu,
stable
Hi Fan,
kernel test robot noticed the following build errors:
[auto build test ERROR on driver-core/driver-core-testing]
[also build test ERROR on driver-core/driver-core-next driver-core/driver-core-linus linus/master v7.2 next-20260821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Fan-Wu/kernfs-recheck-of-released-after-acquiring-the-active-reference/20260821-050720
base: driver-core/driver-core-testing
patch link: https://lore.kernel.org/r/20260821050720.14848-1-fanwu01%40zju.edu.cn
patch subject: [PATCH v2] kernfs: recheck of->released after acquiring the active reference
config: nios2-allnoconfig (https://download.01.org/0day-ci/archive/20260823/202608230052.ZXfVhNjk-lkp@intel.com/config)
compiler: nios2-linux-gcc (GCC) 11.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260823/202608230052.ZXfVhNjk-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608230052.ZXfVhNjk-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/asm-generic/div64.h:27,
from ./arch/nios2/include/generated/asm/div64.h:1,
from include/linux/math.h:6,
from include/linux/math64.h:6,
from include/linux/time.h:6,
from include/linux/stat.h:19,
from include/linux/fs_dirent.h:5,
from include/linux/fs/super_types.h:5,
from include/linux/fs/super.h:5,
from include/linux/fs.h:5,
from fs/kernfs/file.c:10:
fs/kernfs/file.c: In function 'kernfs_get_active_of':
>> include/linux/compiler_types.h:663:16: error: 'sizeof' applied to a bit-field
663 | (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:663:45: error: 'sizeof' applied to a bit-field
663 | (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:664:16: error: 'sizeof' applied to a bit-field
664 | sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:664:44: error: 'sizeof' applied to a bit-field
664 | sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
>> include/asm-generic/rwonce.h:36:54: error: 'sizeof' applied to a bit-field
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
>> include/linux/compiler_types.h:626:17: error: 'typeof' applied to a bit-field
626 | _Generic((x), \
| ^~~~~~~~
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/asm-generic/rwonce.h:44:43: note: in expansion of macro '__unqual_scalar_typeof'
44 | #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x))
| ^~~~~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:50:9: note: in expansion of macro '__READ_ONCE'
50 | __READ_ONCE(x); \
| ^~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
>> include/asm-generic/rwonce.h:44:71: error: cannot take address of bit-field 'released'
44 | #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/asm-generic/rwonce.h:50:9: note: in expansion of macro '__READ_ONCE'
50 | __READ_ONCE(x); \
| ^~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
vim +/sizeof +663 include/linux/compiler_types.h
d15155824c5014 Will Deacon 2017-10-24 611
dee081bf8f824c Will Deacon 2019-12-19 612 /*
dee081bf8f824c Will Deacon 2019-12-19 613 * __unqual_scalar_typeof(x) - Declare an unqualified scalar type, leaving
dee081bf8f824c Will Deacon 2019-12-19 614 * non-scalar types unchanged.
1fd76043ecb04b Marco Elver 2020-05-27 615 */
fd69b2f7d5f4e1 Peter Zijlstra 2026-01-16 616 #ifndef USE_TYPEOF_UNQUAL
1fd76043ecb04b Marco Elver 2020-05-27 617 /*
6ec4476ac82512 Linus Torvalds 2020-07-08 618 * Prefer C11 _Generic for better compile-times and simpler code. Note: 'char'
1fd76043ecb04b Marco Elver 2020-05-27 619 * is not type-compatible with 'signed char', and we define a separate case.
1fd76043ecb04b Marco Elver 2020-05-27 620 */
1fd76043ecb04b Marco Elver 2020-05-27 621 #define __scalar_type_to_expr_cases(type) \
1fd76043ecb04b Marco Elver 2020-05-27 622 unsigned type: (unsigned type)0, \
1fd76043ecb04b Marco Elver 2020-05-27 623 signed type: (signed type)0
1fd76043ecb04b Marco Elver 2020-05-27 624
1fd76043ecb04b Marco Elver 2020-05-27 625 #define __unqual_scalar_typeof(x) typeof( \
1fd76043ecb04b Marco Elver 2020-05-27 @626 _Generic((x), \
1fd76043ecb04b Marco Elver 2020-05-27 627 char: (char)0, \
1fd76043ecb04b Marco Elver 2020-05-27 628 __scalar_type_to_expr_cases(char), \
1fd76043ecb04b Marco Elver 2020-05-27 629 __scalar_type_to_expr_cases(short), \
1fd76043ecb04b Marco Elver 2020-05-27 630 __scalar_type_to_expr_cases(int), \
1fd76043ecb04b Marco Elver 2020-05-27 631 __scalar_type_to_expr_cases(long), \
1fd76043ecb04b Marco Elver 2020-05-27 632 __scalar_type_to_expr_cases(long long), \
1fd76043ecb04b Marco Elver 2020-05-27 633 default: (x)))
fd69b2f7d5f4e1 Peter Zijlstra 2026-01-16 634 #else
fd69b2f7d5f4e1 Peter Zijlstra 2026-01-16 635 #define __unqual_scalar_typeof(x) __typeof_unqual__(x)
fd69b2f7d5f4e1 Peter Zijlstra 2026-01-16 636 #endif
c06cd66387da92 Thomas Gleixner 2026-06-02 637
c06cd66387da92 Thomas Gleixner 2026-06-02 638 #include <asm/percpu_types.h>
c06cd66387da92 Thomas Gleixner 2026-06-02 639
fd69b2f7d5f4e1 Peter Zijlstra 2026-01-16 640 #endif /* !__ASSEMBLY__ */
dee081bf8f824c Will Deacon 2019-12-19 641
38a68b982dd0b1 Peter Zijlstra 2025-11-27 642 /*
38a68b982dd0b1 Peter Zijlstra 2025-11-27 643 * __signed_scalar_typeof(x) - Declare a signed scalar type, leaving
38a68b982dd0b1 Peter Zijlstra 2025-11-27 644 * non-scalar types unchanged.
38a68b982dd0b1 Peter Zijlstra 2025-11-27 645 */
38a68b982dd0b1 Peter Zijlstra 2025-11-27 646
38a68b982dd0b1 Peter Zijlstra 2025-11-27 647 #define __scalar_type_to_signed_cases(type) \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 648 unsigned type: (signed type)0, \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 649 signed type: (signed type)0
38a68b982dd0b1 Peter Zijlstra 2025-11-27 650
38a68b982dd0b1 Peter Zijlstra 2025-11-27 651 #define __signed_scalar_typeof(x) typeof( \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 652 _Generic((x), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 653 char: (signed char)0, \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 654 __scalar_type_to_signed_cases(char), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 655 __scalar_type_to_signed_cases(short), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 656 __scalar_type_to_signed_cases(int), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 657 __scalar_type_to_signed_cases(long), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 658 __scalar_type_to_signed_cases(long long), \
38a68b982dd0b1 Peter Zijlstra 2025-11-27 659 default: (x)))
38a68b982dd0b1 Peter Zijlstra 2025-11-27 660
d15155824c5014 Will Deacon 2017-10-24 661 /* Is this type a native word size -- useful for atomic operations */
815f0ddb346c19 Nick Desaulniers 2018-08-22 662 #define __native_word(t) \
815f0ddb346c19 Nick Desaulniers 2018-08-22 @663 (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
815f0ddb346c19 Nick Desaulniers 2018-08-22 664 sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
815f0ddb346c19 Nick Desaulniers 2018-08-22 665
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] kernfs: recheck of->released after acquiring the active reference
2026-08-21 5:07 ` [PATCH v2] " Fan Wu
2026-08-21 19:21 ` Tejun Heo
2026-08-23 12:27 ` kernel test robot
@ 2026-08-23 12:27 ` kernel test robot
2 siblings, 0 replies; 6+ messages in thread
From: kernel test robot @ 2026-08-23 12:27 UTC (permalink / raw)
To: Fan Wu, gregkh, tj
Cc: oe-kbuild-all, chenridong, driver-core, linux-kernel, Fan Wu,
stable
Hi Fan,
kernel test robot noticed the following build errors:
[auto build test ERROR on driver-core/driver-core-testing]
[also build test ERROR on driver-core/driver-core-next driver-core/driver-core-linus linus/master v7.2 next-20260821]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Fan-Wu/kernfs-recheck-of-released-after-acquiring-the-active-reference/20260821-050720
base: driver-core/driver-core-testing
patch link: https://lore.kernel.org/r/20260821050720.14848-1-fanwu01%40zju.edu.cn
patch subject: [PATCH v2] kernfs: recheck of->released after acquiring the active reference
config: alpha-allnoconfig (https://download.01.org/0day-ci/archive/20260823/202608230046.Ixvo8Av6-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 16.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260823/202608230046.Ixvo8Av6-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202608230046.Ixvo8Av6-lkp@intel.com/
All errors (new ones prefixed by >>):
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:663:45: error: 'sizeof' applied to a bit-field
663 | (sizeof(t) == sizeof(char) || sizeof(t) == sizeof(short) || \
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:664:16: error: 'sizeof' applied to a bit-field
664 | sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/linux/compiler_types.h:664:44: error: 'sizeof' applied to a bit-field
664 | sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:28: note: in expansion of macro '__native_word'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/asm-generic/rwonce.h:36:54: error: 'sizeof' applied to a bit-field
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/linux/compiler_types.h:690:9: note: in expansion of macro '__compiletime_assert'
690 | __compiletime_assert(condition, msg, prefix, suffix)
| ^~~~~~~~~~~~~~~~~~~~
include/linux/compiler_types.h:702:9: note: in expansion of macro '_compiletime_assert'
702 | _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
| ^~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:36:9: note: in expansion of macro 'compiletime_assert'
36 | compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
| ^~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:49:9: note: in expansion of macro 'compiletime_assert_rwonce_type'
49 | compiletime_assert_rwonce_type(x); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
>> fs/kernfs/file.c:76:32: error: 'typeof' applied to a bit-field
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/asm-generic/rwonce.h:44:43: note: in expansion of macro '__unqual_scalar_typeof'
44 | #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x))
| ^~~~~~~~~~~~~~~~~~~~~~
include/asm-generic/rwonce.h:50:9: note: in expansion of macro '__READ_ONCE'
50 | __READ_ONCE(x); \
| ^~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
include/asm-generic/rwonce.h:44:71: error: cannot take address of bit-field 'released'
44 | #define __READ_ONCE(x) (*(const volatile __unqual_scalar_typeof(x) *)&(x))
| ^
include/linux/compiler.h:77:45: note: in definition of macro 'unlikely'
77 | # define unlikely(x) __builtin_expect(!!(x), 0)
| ^
include/asm-generic/rwonce.h:50:9: note: in expansion of macro '__READ_ONCE'
50 | __READ_ONCE(x); \
| ^~~~~~~~~~~
fs/kernfs/file.c:76:22: note: in expansion of macro 'READ_ONCE'
76 | if (unlikely(READ_ONCE(of->released))) {
| ^~~~~~~~~
vim +/typeof +76 fs/kernfs/file.c
65
66 /* Get active reference to kernfs node for an open file */
67 static struct kernfs_open_file *kernfs_get_active_of(struct kernfs_open_file *of)
68 {
69 if (!kernfs_get_active(of->kn))
70 return NULL;
71
72 /*
73 * A successful active reference prevents a new drain and orders this
74 * check after an earlier reactivation.
75 */
> 76 if (unlikely(READ_ONCE(of->released))) {
77 kernfs_put_active(of->kn);
78 return NULL;
79 }
80
81 return of;
82 }
83
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-23 12:27 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-20 2:18 [PATCH] kernfs: recheck of->released after acquiring the active reference Fan Wu
2026-08-20 17:46 ` Tejun Heo
2026-08-21 5:07 ` [PATCH v2] " Fan Wu
2026-08-21 19:21 ` Tejun Heo
2026-08-23 12:27 ` kernel test robot
2026-08-23 12:27 ` kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.