Calling cpt_release_callback on cbt->count != 0 here is really strange
because cbt_page_alloc would anyway do it on decrementing count to zero,
but in opposite case where cbt->count == 0 we should call the callback
but we do not, let's fix it by reversing the condition.

We have a cbt->cache percpu allocation leak detected by kmemleak, which
might be caused by this uncalled release callback.

https://jira.sw.ru/browse/PSBM-141114

Signed-off-by: Pavel Tikhomirov <[email protected]>
---
 block/blk-cbt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-cbt.c b/block/blk-cbt.c
index 2580ccabaa17..054c73c6ef9f 100644
--- a/block/blk-cbt.c
+++ b/block/blk-cbt.c
@@ -540,7 +540,7 @@ void blk_cbt_release(struct request_queue *q)
        rcu_assign_pointer(q->cbt, NULL);
        in_use = cbt->count;
        spin_unlock(&cbt->lock);
-       if (in_use)
+       if (!in_use)
                call_rcu(&cbt->rcu, &cbt_release_callback);
 }
 
-- 
2.37.3

_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel

Reply via email to