fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 232.

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   c9b47175e9131118e6f221cc8fb81397d62e7c91
commit: fa4cdb8cbca7d6cb6aa13e4d8d83d1103f6345db ksmbd: fix session use-after-free in multichannel connection
date:   8 months ago
config: arc-randconfig-r051-20251210 (https://download.01.org/0day-ci/archive/20251210/202512100842.3CPKchLh-lkp@xxxxxxxxx/config)
compiler: arc-linux-gcc (GCC) 14.3.0

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512100842.3CPKchLh-lkp@xxxxxxxxx/

cocci warnings: (new ones prefixed by >>)
>> fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 232.
   fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 237.
   fs/smb/server/mgmt/user_session.c:236:8-27: WARNING: atomic_dec_and_test variation before object free at line 252.
   fs/smb/server/mgmt/user_session.c:256:7-26: WARNING: atomic_dec_and_test variation before object free at line 252.
   fs/smb/server/mgmt/user_session.c:256:7-26: WARNING: atomic_dec_and_test variation before object free at line 257.
   fs/smb/server/mgmt/user_session.c:333:10-29: WARNING: atomic_dec_and_test variation before object free at line 334.

vim +236 fs/smb/server/mgmt/user_session.c

   218	
   219	void ksmbd_sessions_deregister(struct ksmbd_conn *conn)
   220	{
   221		struct ksmbd_session *sess;
   222		unsigned long id;
   223	
   224		down_write(&sessions_table_lock);
   225		if (conn->binding) {
   226			int bkt;
   227			struct hlist_node *tmp;
   228	
   229			hash_for_each_safe(sessions_table, bkt, tmp, sess, hlist) {
   230				if (!ksmbd_chann_del(conn, sess) &&
   231				    xa_empty(&sess->ksmbd_chann_list)) {
 > 232					hash_del(&sess->hlist);
   233					down_write(&conn->session_lock);
   234					xa_erase(&conn->sessions, sess->id);
   235					up_write(&conn->session_lock);
 > 236					if (atomic_dec_and_test(&sess->refcnt))
   237						ksmbd_session_destroy(sess);
   238				}
   239			}
   240		}
   241	
   242		down_write(&conn->session_lock);
   243		xa_for_each(&conn->sessions, id, sess) {
   244			unsigned long chann_id;
   245			struct channel *chann;
   246	
   247			xa_for_each(&sess->ksmbd_chann_list, chann_id, chann) {
   248				if (chann->conn != conn)
   249					ksmbd_conn_set_exiting(chann->conn);
   250			}
   251	
   252			ksmbd_chann_del(conn, sess);
   253			if (xa_empty(&sess->ksmbd_chann_list)) {
   254				xa_erase(&conn->sessions, sess->id);
   255				hash_del(&sess->hlist);
   256				if (atomic_dec_and_test(&sess->refcnt))
   257					ksmbd_session_destroy(sess);
   258			}
   259		}
   260		up_write(&conn->session_lock);
   261		up_write(&sessions_table_lock);
   262	}
   263	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki