linux-kernel - Re: fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20260128045540.GR3183987@ZenIV>
Date: Wed, 28 Jan 2026 04:55:40 +0000
From: Al Viro <viro@...iv.linux.org.uk>
To: kernel test robot <lkp@...el.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
	Jeff Layton <jlayton@...nel.org>, Jan Kara <jack@...e.cz>
Subject: Re: fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation
 before object free at line 2789.

On Wed, Jan 28, 2026 at 08:19:52AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   1f97d9dcf53649c41c33227b345a36902cbb08ad
> commit: 95a4ccbbe596b45264af5e3a019cb920c05ccffd dissolve external_name.u into separate members
> date:   1 year ago
> config: m68k-randconfig-r064-20260128 (https://download.01.org/0day-ci/archive/20260128/202601280811.uLPBZWvT-lkp@intel.com/config)
> compiler: m68k-linux-gcc (GCC) 8.5.0
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202601280811.uLPBZWvT-lkp@intel.com/

> > 2788		if (old_name && likely(atomic_dec_and_test(&old_name->count)))
> > 2789			kfree_rcu(old_name, head);

Warning (along with the identical warnings regarding other places where
we do the same thing to the same object) is a false positive.

Each live dentry with an external name is holding a reference to
that external name; that reference is stabilized by ->d_lock of
that dentry.  All changes are surrounded by bumping ->d_seq of
the same dentry.  Freeing is always RCU-delayed.

There are two places where increments can happen: copy_name() and
take_dentry_name_snapshot().  In both cases dentry in question
is live - the caller must hold a reference to it.  Increment of
external name's refcount can't go from 0 to 1 in either case;
the former is is under target->d_lock, which stabilizes
target->d_name.name and guarantees that refcount is at least 1.
The latter is atomic_inc_not_zero(), within the same RCU read-side
critical area as sampling ->d_seq and fetching the external name;
since freeing is RCU-delayed, the external name in question can't
get freed until we leave that scope, so memory access by
atomic_inc_not_zero() is safe.