dm thin metadata: fix superblock refcount leak on snapshot shadow failure

[PATCH] dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Posted by Genjian 2 weeks ago

From: Genjian Zhang <zhanggenjian@kylinos.cn>

__reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
metadata space map before shadowing it. When dm_tm_shadow_block()
fails, a reference is leaked in the metadata space map.

Fix by adding the missing dm_sm_dec_block().

Fixes: cc8394d86f04 ("dm thin: provide userspace access to pool metadata")
Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
---
 drivers/md/dm-thin-metadata.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c
index b6a2d2081a24..b194fb57d158 100644
--- a/drivers/md/dm-thin-metadata.c
+++ b/drivers/md/dm-thin-metadata.c
@@ -1353,8 +1353,10 @@ static int __reserve_metadata_snap(struct dm_pool_metadata *pmd)
 	dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
 	r = dm_tm_shadow_block(pmd->tm, THIN_SUPERBLOCK_LOCATION,
 			       &sb_validator, &copy, &inc);
-	if (r)
+	if (r) {
+		dm_sm_dec_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
 		return r;
+	}
 
 	BUG_ON(!inc);
 
-- 
2.43.0

Re: [PATCH] dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Posted by Ming Hung Tsai 1 week, 5 days ago

On Sat, Jul 11, 2026 at 6:16 PM Genjian <zhanggenjian@126.com> wrote:
>
> From: Genjian Zhang <zhanggenjian@kylinos.cn>
>
> __reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
> metadata space map before shadowing it. When dm_tm_shadow_block()
> fails, a reference is leaked in the metadata space map.
>
> Fix by adding the missing dm_sm_dec_block().
>
> Fixes: cc8394d86f04 ("dm thin: provide userspace access to pool metadata")
> Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
> ---

The fix looks reasonable as a best-effort cleanup for the immediate
refcount leak.

Re: [PATCH] dm thin metadata: fix superblock refcount leak on snapshot shadow failure

Posted by genjian zhang 1 week, 5 days ago

At 2026-07-13 10:40:48, "Ming Hung Tsai" <mtsai@redhat.com> wrote:
>On Sat, Jul 11, 2026 at 6:16 PM Genjian <zhanggenjian@126.com> wrote:
>>
>> From: Genjian Zhang <zhanggenjian@kylinos.cn>
>>
>> __reserve_metadata_snap() increments THIN_SUPERBLOCK_LOCATION in the
>> metadata space map before shadowing it. When dm_tm_shadow_block()
>> fails, a reference is leaked in the metadata space map.
>>
>> Fix by adding the missing dm_sm_dec_block().
>>
>> Fixes: cc8394d86f04 ("dm thin: provide userspace access to pool metadata")
>> Signed-off-by: Genjian Zhang <zhanggenjian@kylinos.cn>
>> ---
>
>The fix looks reasonable as a best-effort cleanup for the immediate
>refcount leak.

Thanks for the review.

Thanks,
Genjian