From 0e024f580b171fb60c04118fef32977f84e3d3ea Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Mon, 6 Jul 2026 09:29:24 -0400 Subject: [PATCH] sunrpc: tear down pool counters before dropping the pool map reference svc_destroy() drops the service's reference to the global svc_pool_map before iterating serv->sv_pools[] to destroy each pool's percpu counters. That ordering happens to be fine today because the loop is bounded by the per-service sv_nrpools field. A following patch removes sv_nrpools and derives the pool count from the pool map instead. svc_pool_map_put() zeroes svc_pool_map.npools when the last reference is dropped, so a derived loop bound would read as zero for the last pooled service and skip svc_pool_destroy_counters() entirely, leaking the percpu counters (which remain linked on the global percpu_counters list while the svc_serv is freed). Reorder svc_destroy() to destroy the pool counters while the map is still referenced, then drop the reference. No functional change. Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Jeff Layton Link: https://patch.msgid.link/20260706-sunrpc-pool-mode-v5-4-6c4ee7cd89aa@kernel.org Signed-off-by: Chuck Lever --- net/sunrpc/svc.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c index 80640f516dcd..3da0591d1c44 100644 --- a/net/sunrpc/svc.c +++ b/net/sunrpc/svc.c @@ -518,14 +518,15 @@ svc_destroy(struct svc_serv **servp) cache_clean_deferred(serv); - if (serv->sv_is_pooled) - svc_pool_map_put(); - for (i = 0; i < serv->sv_nrpools; i++) { struct svc_pool *pool = &serv->sv_pools[i]; svc_pool_destroy_counters(pool); } + + if (serv->sv_is_pooled) + svc_pool_map_put(); + kfree(serv->sv_pools); kfree(serv); }