Re: fs/dcache.c:2788:24-43: WARNING: atomic_dec_and_test variation before object free at line 2789.

[Al Viro]

On Wed, Jan 28, 2026 at 08:19:52AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   1f97d9dcf53649c41c33227b345a36902cbb08ad
> commit: 95a4ccbbe596b45264af5e3a019cb920c05ccffd dissolve external_name.u into separate members
> date:   1 year ago
> config: m68k-randconfig-r064-20260128 (https://download.01.org/0day-ci/archive/20260128/202601280811.uLPBZWvT-lkp@xxxxxxxxx/config)
> compiler: m68k-linux-gcc (GCC) 8.5.0
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@xxxxxxxxx>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202601280811.uLPBZWvT-lkp@xxxxxxxxx/

> > 2788		if (old_name && likely(atomic_dec_and_test(&old_name->count)))
> > 2789			kfree_rcu(old_name, head);

Warning (along with the identical warnings regarding other places where
we do the same thing to the same object) is a false positive.

Each live dentry with an external name is holding a reference to
that external name; that reference is stabilized by ->d_lock of
that dentry.  All changes are surrounded by bumping ->d_seq of
the same dentry.  Freeing is always RCU-delayed.

There are two places where increments can happen: copy_name() and
take_dentry_name_snapshot().  In both cases dentry in question
is live - the caller must hold a reference to it.  Increment of
external name's refcount can't go from 0 to 1 in either case;
the former is is under target->d_lock, which stabilizes
target->d_name.name and guarantees that refcount is at least 1.
The latter is atomic_inc_not_zero(), within the same RCU read-side
critical area as sampling ->d_seq and fetching the external name;
since freeing is RCU-delayed, the external name in question can't
get freed until we leave that scope, so memory access by
atomic_inc_not_zero() is safe.