Re: [PATCH 6.1.y] Fix memory leak in io_wq_create() on success path

在 2026/8/6 23:29, Greg KH 写道:

> On Thu, Aug 06, 2026 at 10:47:02PM +0800, xk c wrote:
>> Greg KH <[email protected]> 于2026年8月6日周四 22:33写道：
>>> On Thu, Aug 06, 2026 at 10:23:14PM +0800, Chen Xiaokun wrote:
>>>> The commit 657ca82526d0 introduced a temporary allowed_mask cpumask in
>>>> io_wq_create(), which was freed only on the error path.  This caused a
>>>> memory leak of cpumask_size() bytes on every successful io_wq_create().
>>>>
>>>> Fixes: 657ca82526d0 ("io_uring/io-wq: inherit cpuset of cgroup in io worker")
>>>> Signed-off-by: Chen Xiaokun <[email protected]>
>>>> ---
>>>>   io_uring/io-wq.c | 1 +
>>>>   1 file changed, 1 insertion(+)
>>>>
>>>> diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
>>>> index 66fdd69fd6cb..34a1a9067cc2 100644
>>>> --- a/io_uring/io-wq.c
>>>> +++ b/io_uring/io-wq.c
>>>> @@ -1218,6 +1218,7 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
>>>>        wq->task = get_task_struct(data->task);
>>>>        atomic_set(&wq->worker_refs, 1);
>>>>        init_completion(&wq->worker_done);
>>>> +     free_cpumask_var(allowed_mask);
>>>>        return wq;
>>>>   err:
>>>>        io_wq_put_hash(data->hash);
>>>> --
>>>> 2.55.0
>>>>
>>>>
>>> Why is this a stable-only patch?  Was the backport wrong?  Or is this
>>> also in Linus's tree?
>>>
>> Linus's tree has not this issue.
> You need to explain why, in great detail, Linus's tree does not have
> this problem in the changelog.
>
> For example, try answering the questions I asked here, that should
> provide you a framework for what to write.
>
> thnanks,
This is a stable-only patch because the backport introduced a
temporary allowed_mask variable without freeing it on the success
path.  In Linus's tree, it is bound to wq, so there is no memory leak.
> greg k-h
>
>
Thanks for your patience,
Chen