Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a8ba0d60 authored by Lars Ellenberg's avatar Lars Ellenberg Committed by Philipp Reisner
Browse files

drbd: fix drbd_destroy_device reference count updates 



drbd_destroy_device means to give up reference counts
on the connection(s) reachable via the peer_device(s).

It must not do that by iterating via device->resource->connections,
resource and connections may have already been disassociated
by drbd_free_resource, and we'd leak connection refs.

Instead, iterate via device->peer_devices->connection.

Signed-off-by: default avatarPhilipp Reisner <philipp.reisner@linbit.com>
Signed-off-by: default avatarLars Ellenberg <lars.ellenberg@linbit.com>
parent c2258ffc

drivers/block/drbd/drbd_main.c

+9 −5
Original line number Diff line number Diff line
@@ -2160,7 +2160,7 @@ void drbd_destroy_device(struct kref *kref) 
{

	struct drbd_device *device = container_of(kref, struct drbd_device, kref);

	struct drbd_resource *resource = device->resource;

	struct drbd_connection *connection;

	struct drbd_peer_device *peer_device, *tmp_peer_device;



	del_timer_sync(&device->request_timer);
@@ -2191,12 +2191,16 @@ void drbd_destroy_device(struct kref *kref) 
	put_disk(device->vdisk);

	blk_cleanup_queue(device->rq_queue);

	kfree(device->rs_plan_s);

	kfree(first_peer_device(device));



	/* not for_each_connection(connection, resource):

	 * those may have been cleaned up and disassociated already.

	 */

	for_each_peer_device_safe(peer_device, tmp_peer_device, device) {

		kref_put(&peer_device->connection->kref, drbd_destroy_connection);

		kfree(peer_device);

	}

	memset(device, 0xfd, sizeof(*device));

	kfree(device);



	for_each_connection(connection, resource)

		kref_put(&connection->kref, drbd_destroy_connection);

	kref_put(&resource->kref, drbd_destroy_resource);

}