afs_select_fileserver() invokes afs_get_cb_interest(), which returns a reference of the specified afs_cb_interest object to "fc->cbi" with increased refcnt.
The reference counting issue happens in one exception handling path of afs_select_fileserver(). When error occurred in afs_wait_for_fs_probes(), the function forgets to decrease the refcnt increased by afs_get_cb_interest(), causing a refcnt leak. Fix this issue by calling afs_put_cb_interest() when error occurred in afs_wait_for_fs_probes(). Signed-off-by: Xiyu Yang <[email protected]> Signed-off-by: Xin Tan <[email protected]> --- fs/afs/rotate.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/afs/rotate.c b/fs/afs/rotate.c index 2a3305e42b14..f73af16cdb92 100644 --- a/fs/afs/rotate.c +++ b/fs/afs/rotate.c @@ -357,8 +357,10 @@ bool afs_select_fileserver(struct afs_fs_cursor *fc) _debug("pick [%lx]", fc->untried); error = afs_wait_for_fs_probes(fc->server_list, fc->untried); - if (error < 0) + if (error < 0) { + afs_put_cb_interest(afs_v2net(vnode), fc->cbi); goto failed_set_error; + } /* Pick the untried server with the lowest RTT. If we have outstanding * callbacks, we stick with the server we're already using if we can. -- 2.7.4
