[PATCH] memstick: ms_block: destroy io_queue workqueue on removal

[PATCH] memstick: ms_block: destroy io_queue workqueue on removal

[Yifei Gao]

msb_init_disk() creates the per-card ordered workqueue msb->io_queue with
alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only
on the init error path; msb_remove() never destroys it. msb_stop() merely
flushes the queue, and neither msb_data_clear() nor put_disk() free it. As
a result every card insert/remove cycle leaks the workqueue and its
kworker, exhausting kernel memory over repeated cycles.

Destroy the workqueue in msb_remove() after the disk has been removed and
the queue drained.

Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Yifei Gao <gyf161023@gmail.com>
---
 drivers/memstick/core/ms_block.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index ce33907bfc24..65154e569a9e 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -2204,6 +2204,8 @@ static void msb_remove(struct memstick_dev *card)
 	msb_data_clear(msb);
 	mutex_unlock(&msb_disk_lock);
 
+	destroy_workqueue(msb->io_queue);
+
 	put_disk(msb->disk);
 	memstick_set_drvdata(card, NULL);
 }
-- 
2.43.0

Re: [PATCH] memstick: ms_block: destroy io_queue workqueue on removal

[Ulf Hansson]

On Tue, Aug 4, 2026 at 11:35 PM Yifei Gao <gyf161023@gmail.com> wrote:
>
> msb_init_disk() creates the per-card ordered workqueue msb->io_queue with
> alloc_ordered_workqueue(). It is torn down with destroy_workqueue() only
> on the init error path; msb_remove() never destroys it. msb_stop() merely
> flushes the queue, and neither msb_data_clear() nor put_disk() free it. As
> a result every card insert/remove cycle leaks the workqueue and its
> kworker, exhausting kernel memory over repeated cycles.
>
> Destroy the workqueue in msb_remove() after the disk has been removed and
> the queue drained.
>
> Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Yifei Gao <gyf161023@gmail.com>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/memstick/core/ms_block.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
> index ce33907bfc24..65154e569a9e 100644
> --- a/drivers/memstick/core/ms_block.c
> +++ b/drivers/memstick/core/ms_block.c
> @@ -2204,6 +2204,8 @@ static void msb_remove(struct memstick_dev *card)
>         msb_data_clear(msb);
>         mutex_unlock(&msb_disk_lock);
>
> +       destroy_workqueue(msb->io_queue);
> +
>         put_disk(msb->disk);
>         memstick_set_drvdata(card, NULL);
>  }
> --
> 2.43.0
>

[PATCH] memstick: ms_block: destroy io_queue workqueue on removal

[Guangshuo Li]

msb_init_disk() allocates msb->io_queue with alloc_ordered_workqueue(),
while msb_remove() does not destroy the workqueue.

The probe failure path releases the workqueue with destroy_workqueue(),
but the normal removal path only flushes it through msb_stop(). Flushing
a workqueue does not release the workqueue itself, so each card
insert/remove cycle leaks the workqueue and its worker.

Destroy io_queue during removal after the outstanding work has been
drained.

Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/memstick/core/ms_block.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index ce33907bfc24..65154e569a9e 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -2204,6 +2204,8 @@ static void msb_remove(struct memstick_dev *card)
 	msb_data_clear(msb);
 	mutex_unlock(&msb_disk_lock);
 
+	destroy_workqueue(msb->io_queue);
+
 	put_disk(msb->disk);
 	memstick_set_drvdata(card, NULL);
 }
-- 
2.43.0

Re: [PATCH] memstick: ms_block: destroy io_queue workqueue on removal

[Ulf Hansson]

On Tue, Sep 15, 2026 at 5:19 PM Guangshuo Li <lgs201920130244@gmail.com> wrote:
>
> msb_init_disk() allocates msb->io_queue with alloc_ordered_workqueue(),
> while msb_remove() does not destroy the workqueue.
>
> The probe failure path releases the workqueue with destroy_workqueue(),
> but the normal removal path only flushes it through msb_stop(). Flushing
> a workqueue does not release the workqueue itself, so each card
> insert/remove cycle leaks the workqueue and its worker.
>
> Destroy io_queue during removal after the outstanding work has been
> drained.
>
> Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

I have already queued another fix for this, thanks!

Kind regards
Uffe


> ---
>  drivers/memstick/core/ms_block.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
> index ce33907bfc24..65154e569a9e 100644
> --- a/drivers/memstick/core/ms_block.c
> +++ b/drivers/memstick/core/ms_block.c
> @@ -2204,6 +2204,8 @@ static void msb_remove(struct memstick_dev *card)
>         msb_data_clear(msb);
>         mutex_unlock(&msb_disk_lock);
>
> +       destroy_workqueue(msb->io_queue);
> +
>         put_disk(msb->disk);
>         memstick_set_drvdata(card, NULL);
>  }
> --
> 2.43.0
>