[axboe-block:for-6.15/block 75/76] drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

[axboe-block:for-6.15/block 75/76] drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-6.15/block
head:   4c3f4bad7a6e9022489a9f8392f7147ed3ce74b1
commit: dfc77a934a3acdb13dadf237b7417c6a31b19da8 [75/76] loop: try to handle loop aio command via NOWAIT IO first
config: i386-randconfig-052-20250323 (https://download.01.org/0day-ci/archive/20250324/202503240625.LfSMQqA2-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202503240625.LfSMQqA2-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

vim +388 drivers/block/loop.c

bc07c10a3603a5 Ming Lei          2015-08-17  383  
92d773324b7edb Shaohua Li        2017-09-01  384  static void lo_rw_aio_do_completion(struct loop_cmd *cmd)
92d773324b7edb Shaohua Li        2017-09-01  385  {
1894e916546df0 Jens Axboe        2018-04-13  386  	struct request *rq = blk_mq_rq_from_pdu(cmd);
1894e916546df0 Jens Axboe        2018-04-13  387  
92d773324b7edb Shaohua Li        2017-09-01 @388  	if (!atomic_dec_and_test(&cmd->ref))
92d773324b7edb Shaohua Li        2017-09-01  389  		return;
dfc77a934a3acd Ming Lei          2025-03-22  390  
dfc77a934a3acd Ming Lei          2025-03-22  391  	/* -EAGAIN could be returned from bdev's ->ki_complete */
dfc77a934a3acd Ming Lei          2025-03-22  392  	if (cmd->ret == -EAGAIN) {
dfc77a934a3acd Ming Lei          2025-03-22  393  		struct loop_device *lo = rq->q->queuedata;
dfc77a934a3acd Ming Lei          2025-03-22  394  
dfc77a934a3acd Ming Lei          2025-03-22 @395  		loop_queue_work(lo, cmd);
dfc77a934a3acd Ming Lei          2025-03-22  396  		return;
dfc77a934a3acd Ming Lei          2025-03-22  397  	}
dfc77a934a3acd Ming Lei          2025-03-22  398  
92d773324b7edb Shaohua Li        2017-09-01  399  	kfree(cmd->bvec);
15f73f5b3e5958 Christoph Hellwig 2020-06-11  400  	if (likely(!blk_should_fake_timeout(rq->q)))
1894e916546df0 Jens Axboe        2018-04-13  401  		blk_mq_complete_request(rq);
92d773324b7edb Shaohua Li        2017-09-01  402  }
92d773324b7edb Shaohua Li        2017-09-01  403  

:::::: The code at line 388 was first introduced by commit
:::::: 92d773324b7edbd36bf0c28c1e0157763aeccc92 block/loop: fix use after free

:::::: TO: Shaohua Li <shli@fb.com>
:::::: CC: Jens Axboe <axboe@kernel.dk>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: [axboe-block:for-6.15/block 75/76] drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

[Ming Lei]

On Mon, Mar 24, 2025 at 06:52:22AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-6.15/block
> head:   4c3f4bad7a6e9022489a9f8392f7147ed3ce74b1
> commit: dfc77a934a3acdb13dadf237b7417c6a31b19da8 [75/76] loop: try to handle loop aio command via NOWAIT IO first
> config: i386-randconfig-052-20250323 (https://download.01.org/0day-ci/archive/20250324/202503240625.LfSMQqA2-lkp@intel.com/config)
> compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202503240625.LfSMQqA2-lkp@intel.com/
> 
> cocci warnings: (new ones prefixed by >>)
> >> drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

The code itself is safe. Event through the atomic counter drops to zero,
the object isn't freed, and the counter can be re-initialized & requeued
internally.

This cocci rule should be 'wrong', or anyone can explain the exact risk
here?


Thanks,
Ming

Re: [axboe-block:for-6.15/block 75/76] drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.

[Jens Axboe]

On 3/23/25 6:36 PM, Ming Lei wrote:
> On Mon, Mar 24, 2025 at 06:52:22AM +0800, kernel test robot wrote:
>> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git for-6.15/block
>> head:   4c3f4bad7a6e9022489a9f8392f7147ed3ce74b1
>> commit: dfc77a934a3acdb13dadf237b7417c6a31b19da8 [75/76] loop: try to handle loop aio command via NOWAIT IO first
>> config: i386-randconfig-052-20250323 (https://download.01.org/0day-ci/archive/20250324/202503240625.LfSMQqA2-lkp@intel.com/config)
>> compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
>>
>> If you fix the issue in a separate patch/commit (i.e. not just a new version of
>> the same patch/commit), kindly add following tags
>> | Reported-by: kernel test robot <lkp@intel.com>
>> | Closes: https://lore.kernel.org/oe-kbuild-all/202503240625.LfSMQqA2-lkp@intel.com/
>>
>> cocci warnings: (new ones prefixed by >>)
>>>> drivers/block/loop.c:388:6-25: WARNING: atomic_dec_and_test variation before object free at line 395.
> 
> The code itself is safe. Event through the atomic counter drops to zero,
> the object isn't freed, and the counter can be re-initialized & requeued
> internally.
> 
> This cocci rule should be 'wrong', or anyone can explain the exact risk
> here?

It's just a generic thing that it always reports, in case atomic_t is
used where a refcount_t would be "safer". You can just ignore it.

-- 
Jens Axboe