Jann Horn [off-list ref] wrote:

quoted

+               if (!s->s_watchers) {

READ_ONCE() ?

I'm not sure it matters.  It can only be set once, and the next time we read
it we're inside the lock.  And at this point, I don't actually dereference it,
and if it's non-NULL, it's not going to change.

quoted

+                       ret = add_watch_to_object(watch, s->s_watchers);
+                       if (ret == 0) {
+                               spin_lock(&sb_lock);
+                               s->s_count++;
+                               spin_unlock(&sb_lock);

Where is the corresponding decrement of s->s_count? I'm guessing that
it should be in the ->release_watch() handler, except that there isn't
one...

Um.  Good question.  I think this should do the job:

	static void sb_release_watch(struct watch *watch)
	{
		put_super(watch->private);
	}

And this then has to be set later:

	init_watch_list(wlist, sb_release_watch);

quoted

+       } else {
+               ret = -EBADSLT;
+               if (READ_ONCE(s->s_watchers)) {

(Nit: I don't get why you do a lockless check here before taking the
lock - it'd be more straightforward to take the lock first, and it's
not like you want to optimize for the case where someone calls
sys_watch_sb() with invalid arguments...)

Fair enough.  I'll remove it.

quoted

+#ifdef CONFIG_SB_NOTIFICATIONS
+       if (unlikely(s->s_watchers)) {

READ_ONCE() ?

Shouldn't matter.  It's only read once and then a decision is made on it
immediately thereafter.  And if it's non-NULL, the value cannot change
thereafter.

David