[PATCH] lockd: Fix host reference leak in nlmclnt_recovery()

[PATCH] lockd: Fix host reference leak in nlmclnt_recovery()

[Wentao Liang]

In nlmclnt_recovery(), nlm_get_host(host) is called to take a reference
on the host before spawning the reclaimer thread via kthread_run(). If
kthread_run() fails, the reference is never released, and
host->h_reclaiming remains incremented, preventing subsequent reclaim
attempts.

Fix this by releasing the host reference with nlmclnt_release_host(host)
and resetting host->h_reclaiming to 0 on kthread_run() error.

Fixes: df94f000c46c ("lockd: convert reclaimer thread to kthread interface")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 fs/lockd/clntlock.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
index 8fa30c42c92a..aba37847356c 100644
--- a/fs/lockd/clntlock.c
+++ b/fs/lockd/clntlock.c
@@ -216,10 +216,13 @@ nlmclnt_recovery(struct nlm_host *host)
 	if (!host->h_reclaiming++) {
 		nlm_get_host(host);
 		task = kthread_run(reclaimer, host, "%s-reclaim", host->h_name);
-		if (IS_ERR(task))
+		if (IS_ERR(task)) {
 			printk(KERN_ERR "lockd: unable to spawn reclaimer "
 				"thread. Locks for %s won't be reclaimed! "
 				"(%ld)\n", host->h_name, PTR_ERR(task));
+			host->h_reclaiming = 0;
+			nlmclnt_release_host(host);
+		}
 	}
 }
 
-- 
2.34.1

Re: [PATCH] lockd: Fix host reference leak in nlmclnt_recovery()

[Jeff Layton]

On Wed, 2026-09-16 at 07:40 +0000, Wentao Liang wrote:
> In nlmclnt_recovery(), nlm_get_host(host) is called to take a reference
> on the host before spawning the reclaimer thread via kthread_run(). If
> kthread_run() fails, the reference is never released, and
> host->h_reclaiming remains incremented, preventing subsequent reclaim
> attempts.
> 
> Fix this by releasing the host reference with nlmclnt_release_host(host)
> and resetting host->h_reclaiming to 0 on kthread_run() error.
> 
> Fixes: df94f000c46c ("lockd: convert reclaimer thread to kthread interface")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  fs/lockd/clntlock.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/lockd/clntlock.c b/fs/lockd/clntlock.c
> index 8fa30c42c92a..aba37847356c 100644
> --- a/fs/lockd/clntlock.c
> +++ b/fs/lockd/clntlock.c
> @@ -216,10 +216,13 @@ nlmclnt_recovery(struct nlm_host *host)
>  	if (!host->h_reclaiming++) {
>  		nlm_get_host(host);
>  		task = kthread_run(reclaimer, host, "%s-reclaim", host->h_name);
> -		if (IS_ERR(task))
> +		if (IS_ERR(task)) {
>  			printk(KERN_ERR "lockd: unable to spawn reclaimer "
>  				"thread. Locks for %s won't be reclaimed! "
>  				"(%ld)\n", host->h_name, PTR_ERR(task));
> +			host->h_reclaiming = 0;
> +			nlmclnt_release_host(host);
> +		}
>  	}
>  }
>  

Good catch!

Reviewed-by: Jeff Layton <jlayton@kernel.org>