[Devel] [PATCH RHEL9 COMMIT] blk-cbt: fix count decrement and check in cbt_page_alloc

[Konstantin Khorenko]

The commit is pushed to "branch-rh9-5.14.0-70.22.1.vz9.17.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh9-5.14.0-70.22.1.vz9.17.8
------>
commit 2d3dac9baa727ccd9fd5e83ec61ae6ade6d7c381
Author: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
Date:   Wed Nov 2 11:53:27 2022 +0300

    blk-cbt: fix count decrement and check in cbt_page_alloc
    
    Before this line of code cbt->count is always > 0 as it is:
    symmetrically incremented/decremented in this function under cbt->lock,
    and we are at the point just before decrementing it. This means that
    !cbt->count-- (note: postfix decrement returns value before operation)
    is always false and we never enter the true branch of this condition.
    
    It seems the intent was to call release callbacks on reaching zero
    count, let's fix it.
    
    We have a cbt->cache percpu allocation leak detected by kmemleak, which
    might be caused by this uncalled release callback.
    
    https://jira.sw.ru/browse/PSBM-141114
    
    Signed-off-by: Pavel Tikhomirov <ptikhomirov at virtuozzo.com>
    
    Feature: cbt: changed block tracking (for backup)
---
 block/blk-cbt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/blk-cbt.c b/block/blk-cbt.c
index 43a51446eafa..d510838baba1 100644
--- a/block/blk-cbt.c
+++ b/block/blk-cbt.c
@@ -128,7 +128,7 @@ static int cbt_page_alloc(struct cbt_info  **cbt_pp, unsigned long idx,
 	if (in_rcu)
 		rcu_read_lock();
 	spin_lock_irq(&cbt->lock);
-	if (unlikely(!cbt->count-- && test_bit(CBT_DEAD, &cbt->flags))) {
+	if (unlikely(!--(cbt->count) && test_bit(CBT_DEAD, &cbt->flags))) {
 		spin_unlock_irq(&cbt->lock);
 		call_rcu(&cbt->rcu, &cbt_release_callback);
 		if (page)