Skip to content

drbd: Fix local_cnt refcount leak on ascw allocation failure in _drbd_set_state#1008

Open
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1116620=>linus-master
Open

drbd: Fix local_cnt refcount leak on ascw allocation failure in _drbd_set_state#1008
blktests-ci[bot] wants to merge 1 commit into
linus-master_basefrom
series/1116620=>linus-master

Conversation

@blktests-ci

@blktests-ci blktests-ci Bot commented Jun 25, 2026

Copy link
Copy Markdown

Pull request for series with
subject: drbd: Fix local_cnt refcount leak on ascw allocation failure in _drbd_set_state
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1116620

@blktests-ci

blktests-ci Bot commented Jun 25, 2026

Copy link
Copy Markdown
Author

Upstream branch: bade58e
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116620
version: 1

@blktests-ci

blktests-ci Bot commented Jun 26, 2026

Copy link
Copy Markdown
Author

Upstream branch: 4edcdef
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116620
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1116620=>linus-master branch from 226577b to 123f54f Compare June 26, 2026 08:31
@blktests-ci blktests-ci Bot force-pushed the linus-master_base branch from 4cc45a3 to 90ffd56 Compare June 29, 2026 17:14
…_set_state

In _drbd_set_state(), when transitioning a device to D_FAILED or
D_DISKLESS, an extra reference on local_cnt is taken via
atomic_inc(&device->local_cnt) to prevent premature destruction of
the local disk. This reference is normally released by put_ldev()
in after_state_ch(), which is called asynchronously through the
after_state_chg_work (ascw) work item.

If the GFP_ATOMIC allocation of the ascw work item fails, the work
is never queued, after_state_ch() never runs, and the extra
local_cnt reference is permanently leaked. Additionally, the
state_change object allocated by remember_old_state() is also
leaked, along with the krefs it acquired on the resource,
connections, and devices.

Fix both leaks in the ascw allocation failure path:
 - Call put_ldev() to release the extra local_cnt reference when
   the transition matches the same conditions used for the
   atomic_inc.
 - Call forget_state_change() to free the state_change object and
   release the krefs it holds.

Cc: stable@vger.kernel.org
Fixes: d018017 ("drbd: Remove the terrible DEV hack")
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
@blktests-ci

blktests-ci Bot commented Jun 29, 2026

Copy link
Copy Markdown
Author

Upstream branch: dc59e4f
series: https://patchwork.kernel.org/project/linux-block/list/?series=1116620
version: 1

@blktests-ci blktests-ci Bot force-pushed the series/1116620=>linus-master branch from 123f54f to 9b74899 Compare June 29, 2026 17:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant