[PATCH 1/2] nvme-multipath: fix leak on try_module_get failure

[Keith Busch]

On Wed, Apr 15, 2026 at 10:26:00AM +0100, John Garry wrote:
> Are we also missing the module_put() for when we cancel the timer? AFAICS,
> we only put the module for after the disk is removed.

Yes, I believe you are correct.
 
> Maybe we need something like this:
> 
> Subject: [PATCH] nvme-multipath: put module reference when delayed removal
> timer is canceled
> 
> The delayed removal timer is canceled when a NS appears. However, we do not
> put the module reference grabbed in nvme_mpath_remove_disk(), so fix that.
> 
> Signed-off-by: John Garry <john.g.garry at oracle.com>
> 
> diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
> index 1e33af94c24b..1b445830358e 100644
> --- a/drivers/nvme/host/core.c
> +++ b/drivers/nvme/host/core.c
> @@ -4083,7 +4083,8 @@ static int nvme_init_ns_head(struct nvme_ns *ns,
> struct nvme_ns_info *info)
>  	mutex_unlock(&ctrl->subsys->lock);
> 
>  #ifdef CONFIG_NVME_MULTIPATH
> -	cancel_delayed_work(&head->remove_work);
> +	if (cancel_delayed_work_sync(&head->remove_work))
> +		module_put(THIS_MODULE);
>  #endif

I don't think we need the _sync() variant here, but the check and
module_put() look good.