Re: [PATCH] block: blk-mq: fix ws_active refcount leak in blk_mq_mark_tag_wait()

[Keith Busch <kbusch@kernel.org>]

On Tue, May 26, 2026 at 10:37:22AM +0000, Wentao Liang wrote:
> blk_mq_mark_tag_wait() calls sbitmap_queue_get() which increments
> sbq->ws_active. On the error path where the waitqueue_active() check
> fails and the function returns early, sbq->ws_active is not decremented,
> leaking the reference.

I must be confused as I'm not making sense of this. Not only does
blk_mq_mark_tag_wait not call sbitmap_queue_get, sbitmap_queue_get does
not increment sbq->ws_active either. Could you clarify the actual
sequence?
 
> Fix this by calling sbitmap_queue_clear() to properly release the
> ws_active reference before returning on the error path.

And same here, I don't see sbitmap_queue_clear() called anywhere in this
path, nor does sbitmap_queue_clear() release ws_active anyway. What is
the actual sequence that gets there? 

> Fixes: c27d53fb445f ("blk-mq: Reduce the number of if-statements in blk_mq_mark_tag_wait()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  block/blk-mq.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index d0c37daf568f..e1c2ac416693 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -1952,6 +1952,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
>  	spin_lock_irq(&wq->lock);
>  	spin_lock(&hctx->dispatch_wait_lock);
>  	if (!list_empty(&wait->entry)) {
> +		list_del_init(&wait->entry);
> +		atomic_dec(&sbq->ws_active);

As far as I can tell, sbq->ws_active is incremented from three places:

  - blk_mq_mark_tag_wait() itself, but just below this line. So your
    change decrements before the local increment happened, no?
  - sbitmap_prepare_to_wait() / sbitmap_add_wait_queue() in
    lib/sbitmap.c, which are unrelated helpers not used here

What am I missing?