Re: [PATCH 6.1.y] Fix memory leak in io_wq_create() on success path

From: Chen Xiaokun

Date: Thu Aug 06 2026 - 12:25:59 EST

在 2026/8/6 23:29, Greg KH 写道:

On Thu, Aug 06, 2026 at 10:47:02PM +0800, xk c wrote:
Greg KH <gregkh@xxxxxxxxxxxxxxxxxxx> 于2026年8月6日周四 22:33写道：
On Thu, Aug 06, 2026 at 10:23:14PM +0800, Chen Xiaokun wrote:
The commit 657ca82526d0 introduced a temporary allowed_mask cpumask in
io_wq_create(), which was freed only on the error path. This caused a
memory leak of cpumask_size() bytes on every successful io_wq_create().

Fixes: 657ca82526d0 ("io_uring/io-wq: inherit cpuset of cgroup in io worker")
Signed-off-by: Chen Xiaokun <shinnkka1@xxxxxxxxx>
---
io_uring/io-wq.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/io_uring/io-wq.c b/io_uring/io-wq.c
index 66fdd69fd6cb..34a1a9067cc2 100644
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -1218,6 +1218,7 @@ struct io_wq *io_wq_create(unsigned bounded, struct io_wq_data *data)
wq->task = get_task_struct(data->task);
atomic_set(&wq->worker_refs, 1);
init_completion(&wq->worker_done);
+ free_cpumask_var(allowed_mask);
return wq;
err:
io_wq_put_hash(data->hash);
--
2.55.0


Why is this a stable-only patch? Was the backport wrong? Or is this
also in Linus's tree?

Linus's tree has not this issue.
You need to explain why, in great detail, Linus's tree does not have
this problem in the changelog.

For example, try answering the questions I asked here, that should
provide you a framework for what to write.

thnanks,
This is a stable-only patch because the backport introduced a
temporary allowed_mask variable without freeing it on the success
path.  In Linus's tree, it is bound to wq, so there is no memory leak.
greg k-h


Thanks for your patience,
Chen