msb_init_disk() allocates msb->io_queue with alloc_ordered_workqueue(), while msb_remove() does not destroy the workqueue. The probe failure path releases the workqueue with destroy_workqueue(), but the normal removal path only flushes it through msb_stop(). Flushing a workqueue does not release the workqueue itself, so each card insert/remove cycle leaks the workqueue and its worker. Destroy io_queue during removal after the outstanding work has been drained. Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/memstick/core/ms_block.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c index ce33907bfc24..65154e569a9e 100644 --- a/drivers/memstick/core/ms_block.c +++ b/drivers/memstick/core/ms_block.c @@ -2204,6 +2204,8 @@ static void msb_remove(struct memstick_dev *card) msb_data_clear(msb); mutex_unlock(&msb_disk_lock); + destroy_workqueue(msb->io_queue); + put_disk(msb->disk); memstick_set_drvdata(card, NULL); } -- 2.43.0