| Message ID | 20221121111138.3665586-1-bobo.shaobowang@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | drbd: destroy workqueue when drbd device was freed | expand |
Am 21.11.22 um 12:11 schrieb Wang ShaoBo: > A submitter workqueue is dynamically allocated by init_submitter() > called by drbd_create_device(), we should destroy it when this > device was not needed or destroyed. > > Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker") > Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com> > --- > drivers/block/drbd/drbd_main.c | 5 +++++ > 1 file changed, 5 insertions(+) > > diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c > index 8532b839a343..467c498e3add 100644 > --- a/drivers/block/drbd/drbd_main.c > +++ b/drivers/block/drbd/drbd_main.c > @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref) > kfree(peer_device); > } > memset(device, 0xfd, sizeof(*device)); > + > + if (device->submit.wq) > + destroy_workqueue(device->submit.wq); > kfree(device); > kref_put(&resource->kref, drbd_destroy_resource); > } > @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig > put_disk(disk); > out_no_disk: > kref_put(&resource->kref, drbd_destroy_resource); > + if (device->submit.wq) > + destroy_workqueue(device->submit.wq); > kfree(device); > return err; > } Thanks for the patch. Unfortunately, (at least) the first hunk is buggy: we memset() the device to all 0xfd, and try to access it immediately afterwards. This obviously leads to invalid memory access.
在 2022/11/21 19:51, Christoph Böhmwalder 写道: > Am 21.11.22 um 12:11 schrieb Wang ShaoBo: >> A submitter workqueue is dynamically allocated by init_submitter() >> called by drbd_create_device(), we should destroy it when this >> device was not needed or destroyed. >> >> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker") >> Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com> >> --- >> drivers/block/drbd/drbd_main.c | 5 +++++ >> 1 file changed, 5 insertions(+) >> >> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c >> index 8532b839a343..467c498e3add 100644 >> --- a/drivers/block/drbd/drbd_main.c >> +++ b/drivers/block/drbd/drbd_main.c >> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref) >> kfree(peer_device); >> } >> memset(device, 0xfd, sizeof(*device)); >> + >> + if (device->submit.wq) >> + destroy_workqueue(device->submit.wq); >> kfree(device); >> kref_put(&resource->kref, drbd_destroy_resource); >> } >> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig >> put_disk(disk); >> out_no_disk: >> kref_put(&resource->kref, drbd_destroy_resource); >> + if (device->submit.wq) >> + destroy_workqueue(device->submit.wq); >> kfree(device); >> return err; >> } > Thanks for the patch. > > Unfortunately, (at least) the first hunk is buggy: we memset() the > device to all 0xfd, and try to access it immediately afterwards. > > This obviously leads to invalid memory access. Hi Christoph, I found that error, so I have sent a RESEND version, i would be appreciated if you could help check my patch.^-^ -- Wang ShaoBo >
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c index 8532b839a343..467c498e3add 100644 --- a/drivers/block/drbd/drbd_main.c +++ b/drivers/block/drbd/drbd_main.c @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref) kfree(peer_device); } memset(device, 0xfd, sizeof(*device)); + + if (device->submit.wq) + destroy_workqueue(device->submit.wq); kfree(device); kref_put(&resource->kref, drbd_destroy_resource); } @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig put_disk(disk); out_no_disk: kref_put(&resource->kref, drbd_destroy_resource); + if (device->submit.wq) + destroy_workqueue(device->submit.wq); kfree(device); return err; }
A submitter workqueue is dynamically allocated by init_submitter() called by drbd_create_device(), we should destroy it when this device was not needed or destroyed. Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker") Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com> --- drivers/block/drbd/drbd_main.c | 5 +++++ 1 file changed, 5 insertions(+)