Re: [PATCH] md/raid5-ppl: convert pending_flushes from atomic_t to refcount_t

On Mon, Jun 22, 2026 at 01:34:32PM +0530, Sajal Gupta wrote:
> The old atomic_t based counter allowed ppl_do_flush() to continue using io
> after it could already have been freed by ppl_io_unit_finished(), leading
> to a use-after-free.
> 
> Convert pending_flushes from atomic_t to refcount_t with a proper ownership
> model. The creator holds a reference for the duration of ppl_do_flush(),
> and each submitted flush bio holds a reference until its endio callback
> runs. This makes the io lifetime explicit and removes the need for the
> second loop in ppl_do_flush().
> 
> Fixes: 1532d9e87e8b ("raid5-ppl: PPL support for disks with write-back cache enabled")
> Reported-by: Dan Carpenter <[email protected]>
> Closes: https://lore.kernel.org/all/[email protected]/
> Signed-off-by: Sajal Gupta <[email protected]>
> ---

Have you tested this at all because it doesn't seem at all correct to
me...

regards,
dan carpenter