Re: [bug report] Potential atomicity bug in fs/btrfs/compression.c, between btrfs_put_workspace() and free_workspace_manager()

From: Qu Wenruo

Date: Thu Apr 23 2026 - 02:29:34 EST




在 2026/4/23 14:25, Ginger 写道:
Dear Linux kernel maintainers,

My research-based static analyzer found a potential atomicity bug
within the 'fs/btrfs' subsystem, more specifically, in
'fs/btrfs/compression.c'.

I guess your "research-based static analyzer" is some pretty bad LLM.


Kernel version: long-term kernel v6.18.9

Potential concurrent triggering executions:
T0:
btrfs_put_workspace
--> ws_lock = fs_info->compr_wsm[type]->ws_lock;
--> spin_lock(ws_lock)
--> list_add(ws, gwsm->idl_ws)
--> spin_unlock(ws_lock)

T1:
free_workspace_manager
--> gwsm = fs_info->compr_wsm[type];
--> while(!list_empty(gwsm->idle_ws))

Go check when free_workspace_manager() is called.
At that time there should be no compression workload at all, because that's when the super block of the fs is being removed.


In T1, the accesses to the idle_ws are plain memory reads and writes,
without holding the 'ws_lock' to protect against potential data races.

Please kindly check at your convenience. Thank you for your time and
consideration.

Please kindly switch to a better LLM.


Best regards,
Ginger