pmem_attach_disk() allocates the gendisk with blk_alloc_disk() and only
hands it over to devres at the very end, after device_add_disk() has
succeeded:
if (devm_add_action_or_reset(dev, pmem_release_disk, pmem))
return -ENOMEM;
Every error path in between either has nothing to release yet or jumps
to the out: label, which drops the last reference with put_disk(). The
devm_init_badblocks() failure returns directly instead, so on that path
the gendisk, its queue and its bdev inode are never freed. The disk has
been allocated before this check since the check was introduced, so the
leak is as old as the check itself.
Forcing the branch and rebinding a namespace 64 times shows one gendisk
leaked per failed probe: disk_release() is never reached and bdev_cache
grows by 60 objects. With the goto, disk_release() runs on every
attempt and bdev_cache returns to its original size.
Fixes: b95f5f4391fa ("libnvdimm: convert to statically allocated badblocks")
Signed-off-by: Hemanth Selam <[email protected]>
---
drivers/nvdimm/pmem.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 30a51c365ce8..648fc7d66063 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -563,8 +563,10 @@ static int pmem_attach_disk(struct device *dev,
nvdimm_namespace_disk_name(ndns, disk->disk_name);
set_capacity(disk, (pmem->size - pmem->pfn_pad - pmem->data_offset)
/ 512);
- if (devm_init_badblocks(dev, &pmem->bb))
- return -ENOMEM;
+ if (devm_init_badblocks(dev, &pmem->bb)) {
+ rc = -ENOMEM;
+ goto out;
+ }
nvdimm_badblocks_populate(nd_region, &pmem->bb, &bb_range);
disk->bb = &pmem->bb;
--
2.43.7
