[chrome-os:chromeos-6.6 58/58] fs/eventpoll.c:1015:2-11: second lock on line 1000

BCC: [email protected]
CC: [email protected]
TO: [email protected]

tree:   https://chromium.googlesource.com/chromiumos/third_party/kernel chromeos-6.6
head:   e6b498a810705c8763e0d87b16a41ff43b253489
commit: b76f18ffc7719b98cf9c7866e300cfa7da899d4f [58/58] FROMGIT: eventpoll: kill __ep_remove()
:::::: branch date: 15 hours ago
:::::: commit date: 3 days ago
config: arm64-randconfig-r064-20260710 (https://download.01.org/0day-ci/archive/20260710/[email protected]/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project b3e6e6dabdc02153552a64fc74ff5c7532447eed)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Julia Lawall <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

cocci warnings: (new ones prefixed by >>)
>> fs/eventpoll.c:1015:2-11: second lock on line 1000

vim +1015 fs/eventpoll.c

7699acd1341c63f Davide Libenzi    2007-05-10   982  
b611967de4dc5c5 Davide Libenzi    2006-10-11   983  /*
7699acd1341c63f Davide Libenzi    2007-05-10   984   * This is called from eventpoll_release() to unlink files from the eventpoll
7699acd1341c63f Davide Libenzi    2007-05-10   985   * interface. We need to have this facility to cleanup correctly files that are
7699acd1341c63f Davide Libenzi    2007-05-10   986   * closed without being removed from the eventpoll interface.
b611967de4dc5c5 Davide Libenzi    2006-10-11   987   */
7699acd1341c63f Davide Libenzi    2007-05-10   988  void eventpoll_release_file(struct file *file)
b611967de4dc5c5 Davide Libenzi    2006-10-11   989  {
7699acd1341c63f Davide Libenzi    2007-05-10   990  	struct eventpoll *ep;
44cdc1d952e3f7a Al Viro           2020-09-27   991  	struct epitem *epi;
58c9b016e128552 Paolo Abeni       2023-03-22   992  	bool dispose;
58c9b016e128552 Paolo Abeni       2023-03-22   993  
58c9b016e128552 Paolo Abeni       2023-03-22   994  	/*
58c9b016e128552 Paolo Abeni       2023-03-22   995  	 * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from
58c9b016e128552 Paolo Abeni       2023-03-22   996  	 * touching the epitems list before eventpoll_release_file() can access
58c9b016e128552 Paolo Abeni       2023-03-22   997  	 * the ep->mtx.
58c9b016e128552 Paolo Abeni       2023-03-22   998  	 */
58c9b016e128552 Paolo Abeni       2023-03-22   999  again:
58c9b016e128552 Paolo Abeni       2023-03-22 @1000  	spin_lock(&file->f_lock);
58c9b016e128552 Paolo Abeni       2023-03-22  1001  	if (file->f_ep && file->f_ep->first) {
58c9b016e128552 Paolo Abeni       2023-03-22  1002  		epi = hlist_entry(file->f_ep->first, struct epitem, fllink);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1003  		WRITE_ONCE(epi->dying, true);
58c9b016e128552 Paolo Abeni       2023-03-22  1004  		spin_unlock(&file->f_lock);
58c9b016e128552 Paolo Abeni       2023-03-22  1005  
58c9b016e128552 Paolo Abeni       2023-03-22  1006  		/*
58c9b016e128552 Paolo Abeni       2023-03-22  1007  		 * ep access is safe as we still own a reference to the ep
58c9b016e128552 Paolo Abeni       2023-03-22  1008  		 * struct
b611967de4dc5c5 Davide Libenzi    2006-10-11  1009  		 */
7699acd1341c63f Davide Libenzi    2007-05-10  1010  		ep = epi->ep;
58c9b016e128552 Paolo Abeni       2023-03-22  1011  		mutex_lock(&ep->mtx);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1012  
b76f18ffc7719b9 Christian Brauner 2026-06-26  1013  		ep_unregister_pollwait(ep, epi);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1014  
b76f18ffc7719b9 Christian Brauner 2026-06-26 @1015  		spin_lock(&file->f_lock);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1016  		__ep_remove_file(ep, epi, file);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1017  		dispose = __ep_remove_epi(ep, epi);
b76f18ffc7719b9 Christian Brauner 2026-06-26  1018  
d47de16c7221968 Davide Libenzi    2007-05-15  1019  		mutex_unlock(&ep->mtx);
58c9b016e128552 Paolo Abeni       2023-03-22  1020  
521e9ff0b67c66a Linus Torvalds    2025-07-09  1021  		if (dispose && ep_refcount_dec_and_test(ep))
58c9b016e128552 Paolo Abeni       2023-03-22  1022  			ep_free(ep);
58c9b016e128552 Paolo Abeni       2023-03-22  1023  		goto again;
b611967de4dc5c5 Davide Libenzi    2006-10-11  1024  	}
58c9b016e128552 Paolo Abeni       2023-03-22  1025  	spin_unlock(&file->f_lock);
b611967de4dc5c5 Davide Libenzi    2006-10-11  1026  }
b611967de4dc5c5 Davide Libenzi    2006-10-11  1027  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki