On 11/4/26 18:15, Yaohan Li wrote:
> On an error in __send_zone_reset_all(), the submission reference
> held by the dm_io can be decremented there and again by the caller's
> error path. If another clone is still outstanding, the second drop
> can release the dm_io before that clone completes.
>
> Only drop the submission reference in __send_zone_reset_all() on
> success. On failure, leave the reference for the caller's existing
> error handling to release once.
>
> The error path was reproduced under KASAN with an injected GFP_NOIO
> allocation failure while another zone-reset clone remained in
> flight. With the change, the same failure was reported normally,
> without the observed use-after-free, and ordinary zone resets
> continued to work.
>
> Fixes: 81e7706345f06 ("dm: handle REQ_OP_ZONE_RESET_ALL")
> Assisted-by: ZCode:GLM-4
Drop this please.
> Signed-off-by: Yaohan Li <[email protected]>
Looks OK to me.
Reviewed-by: Damien Le Moal <[email protected]>
--
Damien Le Moal
Western Digital Research
