Re: [RFC PATCH 09/25] shrink_dentry_list(): start with removing from shrink list

[Al Viro <viro@zeniv.linux.org.uk>]

On Tue, May 05, 2026 at 06:53:56AM +0100, Al Viro wrote:

> diff --git a/fs/dcache.c b/fs/dcache.c
> index 34d57ed9d791..ee11171a75e6 100644
> --- a/fs/dcache.c
> +++ b/fs/dcache.c
> @@ -1228,19 +1228,19 @@ void shrink_dentry_list(struct list_head *list)

> +		if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
> +			dentry_free(dentry);
> +			spin_unlock(&dentry->d_lock);

In the opposite order, obviously.  It *is* safe in such form, but only
because NORCU dentries placed on shrink lists can't be evicted by
shrink_dentry_tree() (they won't be found by select_collect2()) or
by dput() (once on a shrink list, they have refcount zero and they
never get it incremented afterwards).  So this "if killed by another
thread, with the empty husk left on the shrink list to be disposed of"
can only happen for !NORCU ones, with actual freeing not happening
until we are done with spin_unlock().

But even though that braino does not result in a UAF, we obviously should
just unlock first.  Or, possibly, make dentry_free() called locked and
have it unlock the sucker as the first step...  That would mean
-       if (dentry->d_flags & DCACHE_SHRINK_LIST)
-               can_free = false;
-       spin_unlock(&dentry->d_lock);
-       if (likely(can_free))
+       if (unlikely(dentry->d_flags & DCACHE_SHRINK_LIST))
+               spin_unlock(&dentry->d_lock);
+       else
                dentry_free(dentry);
in dentry_kill(), and to hell with 'can_free' variable in there.
Not sure...

Anyway, for now I'm just fixing that braino; we can always revisit
the calling conventions for dentry_free() later.