On Wed, Apr 23, 2025 at 06:59:41AM +0200, Christoph Hellwig wrote:
> The recent move of the bdev_statx call to the low-level vfs_getattr_nosec
> helper caused it being used by devtmpfs, which leads to deadlocks in
> md teardown due to the block device lookup and put interfering with the
> unusual lifetime rules in md.
>
> But as handle_remove only works on inodes created and owned by devtmpfs
> itself there is no need to use vfs_getattr_nosec vs simply reading the
> mode from the inode directly. Switch to that to avoid the bdev lookup
> or any other unintentional side effect.
>
> Reported-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@xxxxxxx>
> Reported-by: Xiao Ni <xni@xxxxxxxxxx>
> Fixes: 777d0961ff95 ("fs: move the bdex_statx call to vfs_getattr_nosec")
> Signed-off-by: Christoph Hellwig <hch@xxxxxx>
> Tested-by: Shin'ichiro Kawasaki <shinichiro.kawasaki@xxxxxxx>
> Tested-by: Xiao Ni <xni@xxxxxxxxxx>
> ---
> drivers/base/devtmpfs.c | 20 ++++++++------------
> 1 file changed, 8 insertions(+), 12 deletions(-)
...
> @@ -330,11 +329,8 @@ static int handle_remove(const char *nodename, struct device *dev)
> if (IS_ERR(dentry))
> return PTR_ERR(dentry);
>
> - p.mnt = parent.mnt;
> - p.dentry = dentry;
> - err = vfs_getattr(&p, &stat, STATX_TYPE | STATX_MODE,
> - AT_STATX_SYNC_AS_STAT);
> - if (!err && dev_mynode(dev, d_inode(dentry), &stat)) {
> + inode = d_inode(dentry);
> + if (dev_mynode(dev, inode)) {
clang rightfully complains:
CC drivers/base/devtmpfs.o
drivers/base/devtmpfs.c:333:6: warning: variable 'err' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
333 | if (dev_mynode(dev, inode)) {
| ^~~~~~~~~~~~~~~~~~~~~~
drivers/base/devtmpfs.c:358:9: note: uninitialized use occurs here
358 | return err;
| ^~~
drivers/base/devtmpfs.c:333:2: note: remove the 'if' if its condition is always true
333 | if (dev_mynode(dev, inode)) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/base/devtmpfs.c:326:9: note: initialize the variable 'err' to silence this warning
326 | int err;
| ^
| = 0
That is: if dev_mynode(dev, inode) is not true some random value will be returned.
