Re: [PATCH] dm: avoid double-dropping the zone reset submission reference

[Damien Le Moal <dlemoal@kernel.org>]

On 11/4/26 18:15, Yaohan Li wrote:
> On an error in __send_zone_reset_all(), the submission reference
> held by the dm_io can be decremented there and again by the caller's
> error path. If another clone is still outstanding, the second drop
> can release the dm_io before that clone completes.
> 
> Only drop the submission reference in __send_zone_reset_all() on
> success. On failure, leave the reference for the caller's existing
> error handling to release once.
> 
> The error path was reproduced under KASAN with an injected GFP_NOIO
> allocation failure while another zone-reset clone remained in
> flight. With the change, the same failure was reported normally,
> without the observed use-after-free, and ordinary zone resets
> continued to work.
> 
> Fixes: 81e7706345f06 ("dm: handle REQ_OP_ZONE_RESET_ALL")
> Assisted-by: ZCode:GLM-4

Drop this please.

> Signed-off-by: Yaohan Li <shunsheng1218@gmail.com>

Looks OK to me.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>


-- 
Damien Le Moal
Western Digital Research