fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   92514ef226f511f2ca1fb1b8752966097518edc0
commit: 95a4ccbbe596b45264af5e3a019cb920c05ccffd dissolve external_name.u into separate members
date:   10 days ago
config: alpha-randconfig-r053-20250206 (https://download.01.org/0day-ci/archive/20250207/202502070322.IsdN65Ea-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 14.2.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202502070322.IsdN65Ea-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.
   fs/dcache.c:407:13-32: WARNING: atomic_dec_and_test variation before object free at line 408.
   fs/dcache.c:407:13-32: WARNING: atomic_dec_and_test variation before object free at line 416.
   fs/dcache.c:368:15-34: WARNING: atomic_dec_and_test variation before object free at line 369.

vim +2788 fs/dcache.c

  2774	
  2775	static void copy_name(struct dentry *dentry, struct dentry *target)
  2776	{
  2777		struct external_name *old_name = NULL;
  2778		if (unlikely(dname_external(dentry)))
  2779			old_name = external_name(dentry);
  2780		if (unlikely(dname_external(target))) {
  2781			atomic_inc(&external_name(target)->count);
  2782			dentry->d_name = target->d_name;
  2783		} else {
  2784			dentry->d_shortname = target->d_shortname;
  2785			dentry->d_name.name = dentry->d_shortname.string;
  2786			dentry->d_name.hash_len = target->d_name.hash_len;
  2787		}
> 2788		if (old_name && likely(atomic_dec_and_test(&old_name->count)))
> 2789			kfree_rcu(old_name, head);
  2790	}
  2791	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   1f97d9dcf53649c41c33227b345a36902cbb08ad
commit: 95a4ccbbe596b45264af5e3a019cb920c05ccffd dissolve external_name.u into separate members
date:   1 year ago
config: m68k-randconfig-r064-20260128 (https://download.01.org/0day-ci/archive/20260128/202601280811.uLPBZWvT-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 8.5.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202601280811.uLPBZWvT-lkp@intel.com/

cocci warnings: (new ones prefixed by >>)
>> fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.
   fs/dcache.c:407:13-32: WARNING: atomic_dec_and_test variation before object free at line 408.
   fs/dcache.c:407:13-32: WARNING: atomic_dec_and_test variation before object free at line 416.
   fs/dcache.c:368:15-34: WARNING: atomic_dec_and_test variation before object free at line 369.

vim +2788 fs/dcache.c

  2774	
  2775	static void copy_name(struct dentry *dentry, struct dentry *target)
  2776	{
  2777		struct external_name *old_name = NULL;
  2778		if (unlikely(dname_external(dentry)))
  2779			old_name = external_name(dentry);
  2780		if (unlikely(dname_external(target))) {
  2781			atomic_inc(&external_name(target)->count);
  2782			dentry->d_name = target->d_name;
  2783		} else {
  2784			dentry->d_shortname = target->d_shortname;
  2785			dentry->d_name.name = dentry->d_shortname.string;
  2786			dentry->d_name.hash_len = target->d_name.hash_len;
  2787		}
> 2788		if (old_name && likely(atomic_dec_and_test(&old_name->count)))
> 2789			kfree_rcu(old_name, head);
  2790	}
  2791	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

[Al Viro]

On Wed, Jan 28, 2026 at 08:19:52AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   1f97d9dcf53649c41c33227b345a36902cbb08ad
> commit: 95a4ccbbe596b45264af5e3a019cb920c05ccffd dissolve external_name.u into separate members
> date:   1 year ago
> config: m68k-randconfig-r064-20260128 (https://download.01.org/0day-ci/archive/20260128/202601280811.uLPBZWvT-lkp@intel.com/config)
> compiler: m68k-linux-gcc (GCC) 8.5.0
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202601280811.uLPBZWvT-lkp@intel.com/

> > 2788		if (old_name && likely(atomic_dec_and_test(&old_name->count)))
> > 2789			kfree_rcu(old_name, head);

Warning (along with the identical warnings regarding other places where
we do the same thing to the same object) is a false positive.

Each live dentry with an external name is holding a reference to
that external name; that reference is stabilized by ->d_lock of
that dentry.  All changes are surrounded by bumping ->d_seq of
the same dentry.  Freeing is always RCU-delayed.

There are two places where increments can happen: copy_name() and
take_dentry_name_snapshot().  In both cases dentry in question
is live - the caller must hold a reference to it.  Increment of
external name's refcount can't go from 0 to 1 in either case;
the former is is under target->d_lock, which stabilizes
target->d_name.name and guarantees that refcount is at least 1.
The latter is atomic_inc_not_zero(), within the same RCU read-side
critical area as sampling ->d_seq and fetching the external name;
since freeing is RCU-delayed, the external name in question can't
get freed until we leave that scope, so memory access by
atomic_inc_not_zero() is safe.