From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794365005; b=xzkmmi+Bp3vv3XGJtE3ESfAQOqErYPGB4q+KEKMTEfAxXn+u3+qICQF60hJQZOlkYb0C 8KWG4AxlKBoLN3xBqLU6AK84BO3OEIPp+9PKz6FVxJghuX4raiasQmx/Xl0CUxieyx8V9 yX+yPvCLcLJzQCYhsbuU2h+opOfdLqPP0Wt6xQLw/31HMU7o+MywyOBl9bQ0aqJvQwV6E lscBz3VEEBETqKfPwcMJH62VMGjxJRCbx6ajy4JNimxKK7q3vvZJ+U3Ruh13ZFjDmNHFj QqxTqZiWga9rbuAQOIJGc0xkdwaiRn8CAuXj2OKiYgDiCA4VlOaDeQyP5Mj9kATScfA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794365005; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=XqGF9Q/1ydjTzvENWrNs9yiC6HmybG7sTG0CFXXpCho=; b=jXdjKjx3CpPqhI6EbS0akg0eLkOHyAC03xAuHpA9WqvYG5pVtpg+v6rlpes9JpAGYE2O UuhUkez+pQP7TYb84Ovb7L5fIhOQKRagZFtB5Kv8+F01sdIAvaFhkm2y6Ho6au3CPEYqx ICqmIi+K5A0vTI5XfD6AgwhOw0rfYmQ8/B1ZIF2YSB5i3A0jSc4n3fk1gOzqKwd7Gfji1 e/okhbLB/osqN4jWWpW2VQbtlH927ZN1DD1Gat6V/7YVR2mMYCM0zsHNBBeEx+clxg+zA xJJpQLTbTVsS49to8m7a++eFuqXA8YZoZcTPyIC8mAp61x7zaBbTRMH99HalUKBGWRQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=GZip+YhL; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 21CCD606A320 for ; Wed, 11 Nov 2026 02:43:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=GZip+YhL Received: by smtp.kernel.org (Postfix) with ESMTPSA id 568051F0093C; Wed, 11 Nov 2026 02:43:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794365004; bh=XqGF9Q/1ydjTzvENWrNs9yiC6HmybG7sTG0CFXXpCho=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GZip+YhLOp13wL/wJOUFR4lwtwMJHr8NQXhGVy3P1YPCynYsFxET3GLwXoAyaoL70 dVZa72XFClqO6o2SpFQeHnWuiNY/LjeNsMxUatZqH9b6R2EVH1lWGTISTEDzZU8i5b Obqpryu+ggkAcpbDtDoB7wbZ6w+V/imEnZbb6oq6s0NGXAlLgCDekAFxP9Z4zPh+Zw +FuLCHm0pydN4yRH9xf6ded+AMOuQ+FPQnq5dlYg9vHqMgtbyYz3EtO2DloecyzYpK LKLNOqIUVBYf+LFQkCoFZjPiE2D0/L71isXAjpN3yWG5CAB09GbfFZbYnyqwp8zEBE hXbq4lwgqRUQw== From: Sasha Levin To: stable@vger.kernel.org Cc: Mateusz Guzik , Christian Brauner , Sasha Levin Subject: [PATCH 6.18.y 1/6] fs: assert on ->i_count in iput_final() Date: Tue, 10 Nov 2026 21:43:18 -0500 Message-ID: <20261111024017.675599-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261107051338-failed-6.18-8ee09f597763@kernel.org> References: <20261107051338-failed-6.18-8ee09f597763@kernel.org> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Mateusz Guzik [ Upstream commit be97a4b63ca8c3ed8f5c3f5606a15a8379c78afb ] Notably make sure the count is 0 after the return from ->drop_inode(), provided we are going to drop. Inspired by suspicious games played by f2fs. Signed-off-by: Mateusz Guzik Signed-off-by: Christian Brauner Stable-dep-of: 8ee09f597763 ("fs: rotate inodes whose page cache could not be dropped") Signed-off-by: Sasha Levin --- fs/inode.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/inode.c b/fs/inode.c index 24762fd1f2f77..acf09822535ed 100644 --- a/fs/inode.c +++ b/fs/inode.c @@ -1875,6 +1875,7 @@ static void iput_final(struct inode *inode) int drop; WARN_ON(inode->i_state & I_NEW); + VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode); if (op->drop_inode) drop = op->drop_inode(inode); @@ -1889,6 +1890,12 @@ static void iput_final(struct inode *inode) return; } + /* + * Re-check ->i_count in case the ->drop_inode() hooks played games. + * Note we only execute this if the verdict was to drop the inode. + */ + VFS_BUG_ON_INODE(atomic_read(&inode->i_count) != 0, inode); + state = inode->i_state; if (!drop) { WRITE_ONCE(inode->i_state, state | I_WILL_FREE); -- 2.53.0