[PATCH 1/2] nvme-multipath: fix leak on try_module_get failure

[John Garry]

On 25/02/2026 20:21, Keith Busch wrote:
> From: Keith Busch <kbusch at kernel.org>
> 
> We need to fall back to the synchronous removal if we can't get a
> reference on the module needed for the deferred removal.
> 
> Signed-off-by: Keith Busch <kbusch at kernel.org>
> ---
>   drivers/nvme/host/multipath.c | 12 +++++-------
>   1 file changed, 5 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
> index bfcc5904e6a26..fc6800a9f7f94 100644
> --- a/drivers/nvme/host/multipath.c
> +++ b/drivers/nvme/host/multipath.c
> @@ -1310,13 +1310,11 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
>   	if (!list_empty(&head->list))
>   		goto out;
>   
> -	if (head->delayed_removal_secs) {
> -		/*
> -		 * Ensure that no one could remove this module while the head
> -		 * remove work is pending.
> -		 */
> -		if (!try_module_get(THIS_MODULE))
> -			goto out;
> +	/*
> +	 * Ensure that no one could remove this module while the head
> +	 * remove work is pending.
> +	 */
> +	if (head->delayed_removal_secs && try_module_get(THIS_MODULE)) {
>   		mod_delayed_work(nvme_wq, &head->remove_work,
>   				head->delayed_removal_secs * HZ);
>   	} else {


Are we also missing the module_put() for when we cancel the timer? 
AFAICS, we only put the module for after the disk is removed.

Maybe we need something like this:

Subject: [PATCH] nvme-multipath: put module reference when delayed 
removal timer is canceled

The delayed removal timer is canceled when a NS appears. However, we do 
not put the module reference grabbed in nvme_mpath_remove_disk(), so fix 
that.

Signed-off-by: John Garry <john.g.garry at oracle.com>

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 1e33af94c24b..1b445830358e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -4083,7 +4083,8 @@ static int nvme_init_ns_head(struct nvme_ns *ns, 
struct nvme_ns_info *info)
  	mutex_unlock(&ctrl->subsys->lock);

  #ifdef CONFIG_NVME_MULTIPATH
-	cancel_delayed_work(&head->remove_work);
+	if (cancel_delayed_work_sync(&head->remove_work))
+		module_put(THIS_MODULE);
  #endif
  	return 0;