blk_mq_mark_tag_wait() calls sbitmap_queue_get() which increments
sbq->ws_active. On the error path where the waitqueue_active() check
fails and the function returns early, sbq->ws_active is not decremented,
leaking the reference.

Fix this by calling sbitmap_queue_clear() to properly release the
ws_active reference before returning on the error path.

Fixes: c27d53fb445f ("blk-mq: Reduce the number of if-statements in blk_mq_mark_tag_wait()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 block/blk-mq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index d0c37daf568f..e1c2ac416693 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1952,6 +1952,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
 	spin_lock_irq(&wq->lock);
 	spin_lock(&hctx->dispatch_wait_lock);
 	if (!list_empty(&wait->entry)) {
+		list_del_init(&wait->entry);
+		atomic_dec(&sbq->ws_active);
 		spin_unlock(&hctx->dispatch_wait_lock);
 		spin_unlock_irq(&wq->lock);
 		return false;
-- 
2.34.1

On Tue, May 26, 2026 at 10:37:22AM +0000, Wentao Liang wrote:
> blk_mq_mark_tag_wait() calls sbitmap_queue_get() which increments
> sbq->ws_active. On the error path where the waitqueue_active() check
> fails and the function returns early, sbq->ws_active is not decremented,
> leaking the reference.

I must be confused as I'm not making sense of this. Not only does
blk_mq_mark_tag_wait not call sbitmap_queue_get, sbitmap_queue_get does
not increment sbq->ws_active either. Could you clarify the actual
sequence?
 
> Fix this by calling sbitmap_queue_clear() to properly release the
> ws_active reference before returning on the error path.

And same here, I don't see sbitmap_queue_clear() called anywhere in this
path, nor does sbitmap_queue_clear() release ws_active anyway. What is
the actual sequence that gets there? 

> Fixes: c27d53fb445f ("blk-mq: Reduce the number of if-statements in blk_mq_mark_tag_wait()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  block/blk-mq.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index d0c37daf568f..e1c2ac416693 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -1952,6 +1952,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx *hctx,
>  	spin_lock_irq(&wq->lock);
>  	spin_lock(&hctx->dispatch_wait_lock);
>  	if (!list_empty(&wait->entry)) {
> +		list_del_init(&wait->entry);
> +		atomic_dec(&sbq->ws_active);

As far as I can tell, sbq->ws_active is incremented from three places:

  - blk_mq_mark_tag_wait() itself, but just below this line. So your
    change decrements before the local increment happened, no?
  - sbitmap_prepare_to_wait() / sbitmap_add_wait_queue() in
    lib/sbitmap.c, which are unrelated helpers not used here

What am I missing?

On 5/26/26 3:37 AM, Wentao Liang wrote:
> blk_mq_mark_tag_wait() calls sbitmap_queue_get()

I don't see any sbitmap_queue_get() calls in blk_mq_mark_tag_wait().
Additionally, I don't see any other code above the modified code in
blk_mq_mark_tag_wait() that modifies sbq->ws_active directly or
indirectly. What am I missing?

> Fix this by calling sbitmap_queue_clear() to properly release the
> ws_active reference before returning on the error path.

This patch doesn't add a sbitmap_queue_clear() call. It seems like
there is a mismatch between the patch description and the code changes?

Bart.

On Tue, 26 May 2026 10:37:22 +0000, Wentao Liang wrote:
> blk_mq_mark_tag_wait() calls sbitmap_queue_get() which increments
> sbq->ws_active. On the error path where the waitqueue_active() check
> fails and the function returns early, sbq->ws_active is not decremented,
> leaking the reference.
> 
> Fix this by calling sbitmap_queue_clear() to properly release the
> ws_active reference before returning on the error path.
> 
> [...]

Applied, thanks!

[1/1] block: blk-mq: fix ws_active refcount leak in blk_mq_mark_tag_wait()
      commit: 94028f339610f5d39d101449dc27156aea03b3cb

Best regards,
-- 
Jens Axboe