[Drbd-dev] [PATCH] drbd: destroy workqueue when drbd device was freed

[Christoph Böhmwalder]

Am 21.11.22 um 12:11 schrieb Wang ShaoBo:
> A submitter workqueue is dynamically allocated by init_submitter()
> called by drbd_create_device(), we should destroy it when this
> device was not needed or destroyed.
> 
> Fixes: 113fef9e20e0 ("drbd: prepare to queue write requests on a submit worker")
> Signed-off-by: Wang ShaoBo <bobo.shaobowang at huawei.com>
> ---
>  drivers/block/drbd/drbd_main.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
> index 8532b839a343..467c498e3add 100644
> --- a/drivers/block/drbd/drbd_main.c
> +++ b/drivers/block/drbd/drbd_main.c
> @@ -2218,6 +2218,9 @@ void drbd_destroy_device(struct kref *kref)
>  		kfree(peer_device);
>  	}
>  	memset(device, 0xfd, sizeof(*device));
> +
> +	if (device->submit.wq)
> +		destroy_workqueue(device->submit.wq);
>  	kfree(device);
>  	kref_put(&resource->kref, drbd_destroy_resource);
>  }
> @@ -2810,6 +2813,8 @@ enum drbd_ret_code drbd_create_device(struct drbd_config_context *adm_ctx, unsig
>  	put_disk(disk);
>  out_no_disk:
>  	kref_put(&resource->kref, drbd_destroy_resource);
> +	if (device->submit.wq)
> +		destroy_workqueue(device->submit.wq);
>  	kfree(device);
>  	return err;
>  }

Thanks for the patch.

Unfortunately, (at least) the first hunk is buggy: we memset() the
device to all 0xfd, and try to access it immediately afterwards.

This obviously leads to invalid memory access.

-- 
Christoph Böhmwalder
LINBIT | Keeping the Digital World Running
DRBD HA —  Disaster Recovery — Software defined Storage