mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 11:41:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

null_blk: free zones array on device power-off

Browse Source 
null_init_zoned_dev() allocates dev->zones when a zoned device is powered
on, but null_del_dev() never frees it on power-off; dev->zones is only
freed later in null_free_dev(), when the configfs directory is removed. If
the device is powered off and then on again, null_init_zoned_dev()
allocates a new array and overwrites the dev->zones pointer, leaking the
previous allocation each power cycle.

Free dev->zones in null_del_dev() via null_free_zoned_dev() to solve it.
And calling null_free_zoned_dev() in null_free_dev() is no longer necessary
because every caller already invokes null_del_dev() first: via
nullb_group_drop_item() before nullb_device_release(), in the
null_add_dev() error path of null_create_dev(), and in null_destroy_dev().
Remove the redundant call.

And take &lock around zone_cond_store() in the two store wrappers to
serialize dev->zones check-and-deref against its alloc/free, which already
run under &lock. The reason there was no problem before is that only
nullb_device_release() or null_exit() frees the dev->zones, which
guarantees that subsequent users won't access the configfs interface.

Fixes: ca4b2a0119 ("null_blk: add zone support")
Assisted-by: Claude-Code:GLM-5.2
Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20260725022509.714271-6-wozizhi@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Zizhi Wo
2026-07-25 10:25:04 +08:00
committed by Jens Axboe
parent 5a1c5ff3a4
commit 2a6357a9b9
1 changed files with 13 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/block/null_blk/main.c
View File

@@ -579,8 +579,13 @@ static ssize_t nullb_device_zone_readonly_store(struct config_item *item,
const char *page, size_t count)
{
struct nullb_device *dev = to_nullb_device(item);
ssize_t ret;
return zone_cond_store(dev, page, count, BLK_ZONE_COND_READONLY);
mutex_lock(&lock);
ret = zone_cond_store(dev, page, count, BLK_ZONE_COND_READONLY);
mutex_unlock(&lock);
return ret;
}
CONFIGFS_ATTR_WO(nullb_device_, zone_readonly);
@@ -588,8 +593,13 @@ static ssize_t nullb_device_zone_offline_store(struct config_item *item,
const char *page, size_t count)
{
struct nullb_device *dev = to_nullb_device(item);
ssize_t ret;
return zone_cond_store(dev, page, count, BLK_ZONE_COND_OFFLINE);
mutex_lock(&lock);
ret = zone_cond_store(dev, page, count, BLK_ZONE_COND_OFFLINE);
mutex_unlock(&lock);
return ret;
}
CONFIGFS_ATTR_WO(nullb_device_, zone_offline);
@@ -836,7 +846,6 @@ static void null_free_dev(struct nullb_device *dev)
if (!dev)
return;
null_free_zoned_dev(dev);
badblocks_exit(&dev->badblocks);
kfree(dev);
}
@@ -1777,6 +1786,7 @@ static void null_del_dev(struct nullb *nullb)
}
put_disk(nullb->disk);
null_free_zoned_dev(dev);
if (nullb->tag_set == &nullb->__tag_set)
blk_mq_free_tag_set(nullb->tag_set);
kfree(nullb->queues);