[PATCH] block: fix module reference leak in mq-deadline I/O scheduler

[PATCH] block: fix module reference leak in mq-deadline I/O scheduler

[Nilay Shroff]

During probe, when the block layer registers a request queue, it
defaults to the mq-deadline I/O scheduler if the device is single-queue
and the mq-deadline module is available. To determine availability, the
elevator_set_default() invokes elevator_find_get(), which increments the
module's reference count. However, this reference is never released,
resulting in a module reference leak that prevents the mq-deadline module
from being unloaded.

This patch fixes the issue by ensuring the acquired module reference is
properly released.

Fixes: 1e44bedbc921 ("block: unifying elevator change")
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
---
Note: This patch is based on https://lore.kernel.org/all/20250718133232.626418-1-nilay@linux.ibm.com/
So please apply this patch after the above is merged.
---
 block/elevator.c | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/block/elevator.c b/block/elevator.c
index 83d0bfb90a03..2bbf7ad7f4db 100644
--- a/block/elevator.c
+++ b/block/elevator.c
@@ -719,7 +719,8 @@ void elevator_set_default(struct request_queue *q)
 		.name = "mq-deadline",
 		.no_uevent = true,
 	};
-	int err = 0;
+	int err;
+	struct elevator_type *e;
 
 	/* now we allow to switch elevator */
 	blk_queue_flag_clear(QUEUE_FLAG_NO_ELV_SWITCH, q);
@@ -732,12 +733,18 @@ void elevator_set_default(struct request_queue *q)
 	 * have multiple queues or mq-deadline is not available, default
 	 * to "none".
 	 */
-	if (elevator_find_get(ctx.name) && (q->nr_hw_queues == 1 ||
-			 blk_mq_is_shared_tags(q->tag_set->flags)))
+	e = elevator_find_get(ctx.name);
+	if (!e)
+		return;
+
+	if ((q->nr_hw_queues == 1 ||
+			blk_mq_is_shared_tags(q->tag_set->flags))) {
 		err = elevator_change(q, &ctx);
-	if (err < 0)
-		pr_warn("\"%s\" elevator initialization, failed %d, "
-			"falling back to \"none\"\n", ctx.name, err);
+		if (err < 0)
+			pr_warn("\"%s\" elevator initialization, failed %d, falling back to \"none\"\n",
+					ctx.name, err);
+	}
+	elevator_put(e);
 }
 
 void elevator_set_none(struct request_queue *q)
-- 
2.50.1

Re: [PATCH] block: fix module reference leak in mq-deadline I/O scheduler

[Ming Lei]

On Sat, Jul 19, 2025 at 06:56:47PM +0530, Nilay Shroff wrote:
> During probe, when the block layer registers a request queue, it
> defaults to the mq-deadline I/O scheduler if the device is single-queue
> and the mq-deadline module is available. To determine availability, the
> elevator_set_default() invokes elevator_find_get(), which increments the
> module's reference count. However, this reference is never released,
> resulting in a module reference leak that prevents the mq-deadline module
> from being unloaded.
> 
> This patch fixes the issue by ensuring the acquired module reference is
> properly released.
> 
> Fixes: 1e44bedbc921 ("block: unifying elevator change")
> Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
> ---
> Note: This patch is based on https://lore.kernel.org/all/20250718133232.626418-1-nilay@linux.ibm.com/
> So please apply this patch after the above is merged.
> ---
>  block/elevator.c | 19 +++++++++++++------
>  1 file changed, 13 insertions(+), 6 deletions(-)
> 
> diff --git a/block/elevator.c b/block/elevator.c
> index 83d0bfb90a03..2bbf7ad7f4db 100644
> --- a/block/elevator.c
> +++ b/block/elevator.c
> @@ -719,7 +719,8 @@ void elevator_set_default(struct request_queue *q)
>  		.name = "mq-deadline",
>  		.no_uevent = true,
>  	};
> -	int err = 0;
> +	int err;
> +	struct elevator_type *e;
>  
>  	/* now we allow to switch elevator */
>  	blk_queue_flag_clear(QUEUE_FLAG_NO_ELV_SWITCH, q);
> @@ -732,12 +733,18 @@ void elevator_set_default(struct request_queue *q)
>  	 * have multiple queues or mq-deadline is not available, default
>  	 * to "none".
>  	 */
> -	if (elevator_find_get(ctx.name) && (q->nr_hw_queues == 1 ||
> -			 blk_mq_is_shared_tags(q->tag_set->flags)))
> +	e = elevator_find_get(ctx.name);
> +	if (!e)
> +		return;
> +
> +	if ((q->nr_hw_queues == 1 ||
> +			blk_mq_is_shared_tags(q->tag_set->flags))) {
>  		err = elevator_change(q, &ctx);
> -	if (err < 0)
> -		pr_warn("\"%s\" elevator initialization, failed %d, "
> -			"falling back to \"none\"\n", ctx.name, err);
> +		if (err < 0)
> +			pr_warn("\"%s\" elevator initialization, failed %d, falling back to \"none\"\n",
> +					ctx.name, err);
> +	}
> +	elevator_put(e);

Looks fine,

Reviewed-by: Ming Lei <ming.lei@redhat.com>


Thanks,
Ming

Re: [PATCH] block: fix module reference leak in mq-deadline I/O scheduler

[Hannes Reinecke]

On 7/19/25 15:26, Nilay Shroff wrote:
> During probe, when the block layer registers a request queue, it
> defaults to the mq-deadline I/O scheduler if the device is single-queue
> and the mq-deadline module is available. To determine availability, the
> elevator_set_default() invokes elevator_find_get(), which increments the
> module's reference count. However, this reference is never released,
> resulting in a module reference leak that prevents the mq-deadline module
> from being unloaded.
> 
> This patch fixes the issue by ensuring the acquired module reference is
> properly released.
> 
> Fixes: 1e44bedbc921 ("block: unifying elevator change")
> Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
> ---
> Note: This patch is based on https://lore.kernel.org/all/20250718133232.626418-1-nilay@linux.ibm.com/
> So please apply this patch after the above is merged.
> ---
>   block/elevator.c | 19 +++++++++++++------
>   1 file changed, 13 insertions(+), 6 deletions(-)
> 
Reviewed-by: Hannes Reinecke <hare@suse.de>

Cheers,

Hannes
-- 
Dr. Hannes Reinecke                  Kernel Storage Architect
hare@suse.de                                +49 911 74053 688
SUSE Software Solutions GmbH, Frankenstr. 146, 90461 Nürnberg
HRB 36809 (AG Nürnberg), GF: I. Totev, A. McDonald, W. Knoblich

Re: [PATCH] block: fix module reference leak in mq-deadline I/O scheduler

[Jens Axboe]

On Sat, 19 Jul 2025 18:56:47 +0530, Nilay Shroff wrote:
> During probe, when the block layer registers a request queue, it
> defaults to the mq-deadline I/O scheduler if the device is single-queue
> and the mq-deadline module is available. To determine availability, the
> elevator_set_default() invokes elevator_find_get(), which increments the
> module's reference count. However, this reference is never released,
> resulting in a module reference leak that prevents the mq-deadline module
> from being unloaded.
> 
> [...]

Applied, thanks!

[1/1] block: fix module reference leak in mq-deadline I/O scheduler
      commit: 1966554b2e82b89d4f6490f430ce76a379e23f1f

Best regards,
-- 
Jens Axboe