[PATCH] kernfs: fix suspicious RCU usage in kernfs_put()

[PATCH] kernfs: fix suspicious RCU usage in kernfs_put()

[Conor Kotwasinski]

Commit 741c10b096bc ("kernfs: Use RCU to access kernfs_node::name.")
converted the WARN_ONCE() in kernfs_put() to read kn->name and
parent->name via rcu_dereference(), but kernfs_put() has callers that
hold neither kernfs_rwsem nor the RCU read lock. The inode eviction
path driven by memory reclaim is one such case:

  kernfs_put+0x53/0x60 fs/kernfs/dir.c:602
  evict+0x3c2/0xad0 fs/inode.c:846
  iput_final fs/inode.c:1966 [inline]
  iput.part.0+0x605/0xf50 fs/inode.c:2015
  iput+0x35/0x40 fs/inode.c:1981
  dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
  __dentry_kill+0x1d0/0x600 fs/dcache.c:670
  shrink_dentry_list+0x180/0x5e0 fs/dcache.c:1174
  prune_dcache_sb+0xea/0x150 fs/dcache.c:1256
  super_cache_scan+0x328/0x550 fs/super.c:223
  ...
  kswapd+0x556/0xba0 mm/vmscan.c:7343

lockdep complains with "suspicious RCU usage" whenever the WARN
fires from such a context.

Wrap the rcu_dereference() calls in an RCU read-side critical section.
Gate on the active-ref check so the lock is only taken when the WARN
is about to fire.

Note that this does not address the underlying imbalance in
kn->active that triggers the WARN.

Fixes: 741c10b096bc ("kernfs: Use RCU to access kernfs_node::name.")
Reported-by: syzbot+0dfe499ea713e0a15bec@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0dfe499ea713e0a15bec

Signed-off-by: Conor Kotwasinski <conorkotwasinski2024@u.northwestern.edu>
---
 fs/kernfs/dir.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c
index 4f9ade82b08a..e88b71607f1e 100644
--- a/fs/kernfs/dir.c
+++ b/fs/kernfs/dir.c
@@ -597,10 +597,13 @@ void kernfs_put(struct kernfs_node *kn)
 	 */
 	parent = kernfs_parent(kn);
 
-	WARN_ONCE(atomic_read(&kn->active) != KN_DEACTIVATED_BIAS,
-		  "kernfs_put: %s/%s: released with incorrect active_ref %d\n",
-		  parent ? rcu_dereference(parent->name) : "",
-		  rcu_dereference(kn->name), atomic_read(&kn->active));
+	if (atomic_read(&kn->active) != KN_DEACTIVATED_BIAS) {
+		guard(rcu)();
+		WARN_ONCE(1,
+			  "kernfs_put: %s/%s: released with incorrect active_ref %d\n",
+			  parent ? rcu_dereference(parent->name) : "",
+			  rcu_dereference(kn->name), atomic_read(&kn->active));
+	}
 
 	if (kernfs_type(kn) == KERNFS_LINK)
 		kernfs_put(kn->symlink.target_kn);
-- 
2.53.0

Re: [PATCH] kernfs: fix suspicious RCU usage in kernfs_put()

[Tejun Heo]

On Thu, Apr 16, 2026 at 09:43:15AM -0400, Conor Kotwasinski wrote:
> Commit 741c10b096bc ("kernfs: Use RCU to access kernfs_node::name.")
> converted the WARN_ONCE() in kernfs_put() to read kn->name and
> parent->name via rcu_dereference(), but kernfs_put() has callers that
> hold neither kernfs_rwsem nor the RCU read lock. The inode eviction
> path driven by memory reclaim is one such case:
> 
>   kernfs_put+0x53/0x60 fs/kernfs/dir.c:602
>   evict+0x3c2/0xad0 fs/inode.c:846
>   iput_final fs/inode.c:1966 [inline]
>   iput.part.0+0x605/0xf50 fs/inode.c:2015
>   iput+0x35/0x40 fs/inode.c:1981
>   dentry_unlink_inode+0x2a1/0x490 fs/dcache.c:467
>   __dentry_kill+0x1d0/0x600 fs/dcache.c:670
>   shrink_dentry_list+0x180/0x5e0 fs/dcache.c:1174
>   prune_dcache_sb+0xea/0x150 fs/dcache.c:1256
>   super_cache_scan+0x328/0x550 fs/super.c:223
>   ...
>   kswapd+0x556/0xba0 mm/vmscan.c:7343
> 
> lockdep complains with "suspicious RCU usage" whenever the WARN
> fires from such a context.
> 
> Wrap the rcu_dereference() calls in an RCU read-side critical section.
> Gate on the active-ref check so the lock is only taken when the WARN
> is about to fire.
> 
> Note that this does not address the underlying imbalance in
> kn->active that triggers the WARN.
> 
> Fixes: 741c10b096bc ("kernfs: Use RCU to access kernfs_node::name.")
> Reported-by: syzbot+0dfe499ea713e0a15bec@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=0dfe499ea713e0a15bec
> 
> Signed-off-by: Conor Kotwasinski <conorkotwasinski2024@u.northwestern.edu>

Acked-by: Tejun Heo <tj@kernel.org>

Thanks.

-- 
tejun