Am 21.11.22 um 12:11 schrieb Wang ShaoBo:
> A submitter workqueue is dynamically allocated by init_submitter()
> called by drbd_create_device(), we should destroy it when this
> device was not needed or destroyed.
>
> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
> Signed-off-by: Wang ShaoBo <bobo.shaobowang@xxxxxxxxxx>
> ---
> drivers/block/drbd/drbd_main.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
> index 8532b839a343..467c498e3add 100644
> --- a/drivers/block/drbd/drbd_main.c
> +++ b/drivers/block/drbd/drbd_main.c
> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
> kfree(peer_device);
> }
> memset(device, 0xfd, sizeof(*device));
> +
> + if (device->submit.wq)
> + destroy_workqueue(device->submit.wq);
> kfree(device);
> kref_put(&resource->kref, drbd_destroy_resource);
> }
> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
> put_disk(disk);
> out_no_disk:
> kref_put(&resource->kref, drbd_destroy_resource);
> + if (device->submit.wq)
> + destroy_workqueue(device->submit.wq);
> kfree(device);
> return err;
> }
Thanks for the patch.
Unfortunately, (at least) the first hunk is buggy: we memset() the
device to all 0xfd, and try to access it immediately afterwards.
This obviously leads to invalid memory access.
--
Christoph Böhmwalder
LINBIT | Keeping the Digital World Running
DRBD HA — Disaster Recovery — Software defined Storage
