On Sat, 2018-07-07 at 18:48 +0200, Greg Kroah-Hartman wrote: > No, kobject_get() should never happen on a 0 refcount object. That > being said, the code does allow it, so if things are messed up, it will > happen. I think that change happened when the switch to refcount_t > occured, before then we would WARN_ON() if that ever happened. I should > go fix that up, and restore that old behavior, so that syzbot starts > complaining loudly when stuff like that hits. > > So I hate using kobject_get_unless_zero(), and resisted ever adding it > to the tree as it shows a bad locking/tree situation as you point out > here. But for some reason, the block developers seemed to insist they > needed it, and so it is in the tree for them. I don't want it to spread > if at all possible, which makes me want to reject this patch as this > should be "a case that can never be hit".
Except it can in that situation... at least unless you get my patch 2/2 (or the newer one I'm about to send that avoids adding a child counter and uses the one in kernfs instead). Ben.
