[Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

[Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

[Wang ShaoBo]

A submitter workqueue is dynamically allocated by init_submitter()
called by drbd_create_device(), we should destroy it when this
device was not needed or destroyed.

Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
---
 drivers/block/drbd/drbd_main.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 8532b839a343..467c498e3add 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
 		kfree(peer_device);
 	}
 	memset(device, 0xfd, sizeof(*device));
+
+	if (device->submit.wq)
+		destroy_workqueue(device->submit.wq);
 	kfree(device);
 	kref_put(&resource->kref, drbd_destroy_resource);
 }
@@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
 	put_disk(disk);
 out_no_disk:
 	kref_put(&resource->kref, drbd_destroy_resource);
+	if (device->submit.wq)
+		destroy_workqueue(device->submit.wq);
 	kfree(device);
 	return err;
 }
-- 
2.25.1

Re: [Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

[Christoph Böhmwalder]

Am 21.11.22 um 12:11 schrieb Wang ShaoBo:
> A submitter workqueue is dynamically allocated by init_submitter()
> called by drbd_create_device(), we should destroy it when this
> device was not needed or destroyed.
> 
> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
> Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
> ---
>  drivers/block/drbd/drbd_main.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
> index 8532b839a343..467c498e3add 100644
> --- a/drivers/block/drbd/drbd_main.c
> +++ b/drivers/block/drbd/drbd_main.c
> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
>  		kfree(peer_device);
>  	}
>  	memset(device, 0xfd, sizeof(*device));
> +
> +	if (device->submit.wq)
> +		destroy_workqueue(device->submit.wq);
>  	kfree(device);
>  	kref_put(&resource->kref, drbd_destroy_resource);
>  }
> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
>  	put_disk(disk);
>  out_no_disk:
>  	kref_put(&resource->kref, drbd_destroy_resource);
> +	if (device->submit.wq)
> +		destroy_workqueue(device->submit.wq);
>  	kfree(device);
>  	return err;
>  }

Thanks for the patch.

Unfortunately, (at least) the first hunk is buggy: we memset() the
device to all 0xfd, and try to access it immediately afterwards.

This obviously leads to invalid memory access.

-- 
Christoph Böhmwalder
LINBIT | Keeping the Digital World Running
DRBD HA —  Disaster Recovery — Software defined Storage

Re: [Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

[Wangshaobo (bobo)]

在 2022/11/21 19:51, Christoph Böhmwalder 写道:
> Am 21.11.22 um 12:11 schrieb Wang ShaoBo:
>> A submitter workqueue is dynamically allocated by init_submitter()
>> called by drbd_create_device(), we should destroy it when this
>> device was not needed or destroyed.
>>
>> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
>> Signed-off-by: Wang ShaoBo <bobo.shaobowang@huawei.com>
>> ---
>>   drivers/block/drbd/drbd_main.c | 5 +++++
>>   1 file changed, 5 insertions(+)
>>
>> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
>> index 8532b839a343..467c498e3add 100644
>> --- a/drivers/block/drbd/drbd_main.c
>> +++ b/drivers/block/drbd/drbd_main.c
>> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
>>   		kfree(peer_device);
>>   	}
>>   	memset(device, 0xfd, sizeof(*device));
>> +
>> +	if (device->submit.wq)
>> +		destroy_workqueue(device->submit.wq);
>>   	kfree(device);
>>   	kref_put(&resource->kref, drbd_destroy_resource);
>>   }
>> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
>>   	put_disk(disk);
>>   out_no_disk:
>>   	kref_put(&resource->kref, drbd_destroy_resource);
>> +	if (device->submit.wq)
>> +		destroy_workqueue(device->submit.wq);
>>   	kfree(device);
>>   	return err;
>>   }
> Thanks for the patch.
>
> Unfortunately, (at least) the first hunk is buggy: we memset() the
> device to all 0xfd, and try to access it immediately afterwards.
>
> This obviously leads to invalid memory access.

Hi Christoph,

I found that error, so I have sent a RESEND version, i would be appreciated

if you could help check my patch.^-^

-- Wang ShaoBo

>