linux-kernel - Re: kernel/bpf/token.c:50:6-27: WARNING: atomic_dec_and_test variation before object free at line 54.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAEf4BzZ=Rf+-_SSbtL+wZkX0XPrCfh3FBUCnR21qENAh0YMcFw@mail.gmail.com>
Date: Mon, 14 Oct 2024 13:13:56 -0700
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: kernel test robot <lkp@...el.com>
Cc: Andrii Nakryiko <andrii@...nel.org>, oe-kbuild-all@...ts.linux.dev, 
	linux-kernel@...r.kernel.org, Alexei Starovoitov <ast@...nel.org>
Subject: Re: kernel/bpf/token.c:50:6-27: WARNING: atomic_dec_and_test
 variation before object free at line 54.

On Sat, Oct 12, 2024 at 11:58 PM kernel test robot <lkp@...el.com> wrote:
>
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   36c254515dc6592c44db77b84908358979dd6b50
> commit: 35f96de04127d332a5c5e8a155d31f452f88c76d bpf: Introduce BPF token object
> date:   9 months ago
> config: alpha-randconfig-r054-20241012 (https://download.01.org/0day-ci/archive/20241013/202410131412.5csjqw8L-lkp@intel.com/config)
> compiler: alpha-linux-gcc (GCC) 13.3.0
>
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202410131412.5csjqw8L-lkp@intel.com/
>
> cocci warnings: (new ones prefixed by >>)
> >> kernel/bpf/token.c:50:6-27: WARNING: atomic_dec_and_test variation before object free at line 54.

Can someone please explain what this means and why the code below is
broken, according to coccinelle?

>
> vim +50 kernel/bpf/token.c
>
>     44
>     45  void bpf_token_put(struct bpf_token *token)
>     46  {
>     47          if (!token)
>     48                  return;
>     49
>   > 50          if (!atomic64_dec_and_test(&token->refcnt))
>     51                  return;
>     52
>     53          INIT_WORK(&token->work, bpf_token_put_deferred);
>   > 54          schedule_work(&token->work);

this is not "object free", but even if it was, I still don't see the
problem, tbh...

>     55  }
>     56
>
> --
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki