From: kernel test robot <lkp@intel.com>
To: Namjae Jeon <linkinjeon@kernel.org>
Cc: oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org,
Steve French <stfrench@microsoft.com>
Subject: fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 232.
Date: Wed, 10 Dec 2025 09:03:01 +0800 [thread overview]
Message-ID: <202512100842.3CPKchLh-lkp@intel.com> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: c9b47175e9131118e6f221cc8fb81397d62e7c91
commit: fa4cdb8cbca7d6cb6aa13e4d8d83d1103f6345db ksmbd: fix session use-after-free in multichannel connection
date: 8 months ago
config: arc-randconfig-r051-20251210 (https://download.01.org/0day-ci/archive/20251210/202512100842.3CPKchLh-lkp@intel.com/config)
compiler: arc-linux-gcc (GCC) 14.3.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512100842.3CPKchLh-lkp@intel.com/
cocci warnings: (new ones prefixed by >>)
>> fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 232.
fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 237.
fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 252.
fs/smb/server/mgmt/user_session.c:256:7-26: WARNING: atomic_dec_and_test variation before object free at line 252.
fs/smb/server/mgmt/user_session.c:256:7-26: WARNING: atomic_dec_and_test variation before object free at line 257.
fs/smb/server/mgmt/user_session.c:333:10-29: WARNING: atomic_dec_and_test variation before object free at line 334.
vim +236 fs/smb/server/mgmt/user_session.c
218
219 void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
220 {
221 struct ksmbd_session *sess;
222 unsigned long id;
223
224 down_write(&sessions_table_lock);
225 if (conn->binding) {
226 int bkt;
227 struct hlist_node *tmp;
228
229 hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
230 if (!ksmbd_chann_del(conn, sess) &&
231 xa_empty(&sess->ksmbd_chann_list)) {
> 232 hash_del(&sess->hlist);
233 down_write(&conn->session_lock);
234 xa_erase(&conn->sessions, sess->id);
235 up_write(&conn->session_lock);
> 236 if (atomic_dec_and_test(&sess->refcnt))
237 ksmbd_session_destroy(sess);
238 }
239 }
240 }
241
242 down_write(&conn->session_lock);
243 xa_for_each(&conn->sessions, id, sess) {
244 unsigned long chann_id;
245 struct channel *chann;
246
247 xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) {
248 if (chann->conn != conn)
249 ksmbd_conn_set_exiting(chann->conn);
250 }
251
252 ksmbd_chann_del(conn, sess);
253 if (xa_empty(&sess->ksmbd_chann_list)) {
254 xa_erase(&conn->sessions, sess->id);
255 hash_del(&sess->hlist);
256 if (atomic_dec_and_test(&sess->refcnt))
257 ksmbd_session_destroy(sess);
258 }
259 }
260 up_write(&conn->session_lock);
261 up_write(&sessions_table_lock);
262 }
263
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2025-12-10 1:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202512100842.3CPKchLh-lkp@intel.com \
--to=lkp@intel.com \
--cc=linkinjeon@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=stfrench@microsoft.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox