Re: [Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

["Wangshaobo (bobo)" <bobo.shaobowang@huawei.com>]

在 2022/11/21 19:51, Christoph Böhmwalder 写道:
> Am 21.11.22 um 12:11 schrieb Wang ShaoBo:
>> A submitter workqueue is dynamically allocated by init_submitter()
>> called by drbd_create_device(), we should destroy it when this
>> device was not needed or destroyed.
>>
>> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
>> Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
>> ---
>>   drivers/block/drbd/drbd_main.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
>> index 8532b839a343..467c498e3add 100644
>> --- a/drivers/block/drbd/drbd_main.c
>> +++ b/drivers/block/drbd/drbd_main.c
>> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
>>   		kfree(peer_device);
>>   	}
>>   	memset(device, 0xfd, sizeof(*device));
>> +
>> +	if (device->submit.wq)
>> +		destroy_workqueue(device->submit.wq);
>>   	kfree(device);
>>   	kref_put(&resource->kref, drbd_destroy_resource);
>>   }
>> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
>>   	put_disk(disk);
>>   out_no_disk:
>>   	kref_put(&resource->kref, drbd_destroy_resource);
>> +	if (device->submit.wq)
>> +		destroy_workqueue(device->submit.wq);
>>   	kfree(device);
>>   	return err;
>>   }
> Thanks for the patch.
>
> Unfortunately, (at least) the first hunk is buggy: we memset() the
> device to all 0xfd, and try to access it immediately afterwards.
>
> This obviously leads to invalid memory access.

Hi Christoph,

I found that error, so I have sent a RESEND version, i would be appreciated

if you could help check my patch.^-^

-- Wang ShaoBo

>