Re: [PATCH v8 0/3] MR4243: rtworkq: free cancelled work items

[Yuxuan Shui (＠yshui)]

On Wed Mar  6 08:05:54 2024 +0000, Zhiyi Zhang wrote:
> After 7865026, won't the callback be eventually released in
> scheduled_item_cancelable_callback() or
> waiting_item_cancelable_callback()? How does the memory leak happen? If
> you're referring to the callback reference count should immediately be
> zero after calling MFCancelWorkItem(), I don't think that's that big of
> an issue. Is there an application that depends on the reference count
> being zero immediately after MFCancelWorkItem()?

the callbacks aren't guaranteed to run. note that the callbacks decrement the refcount _twice_, once in `queue_release_pending_item`, once directly; whereas `queue_cancel_item` only does it once. so if the callbacks aren't run, the `work_item` is leaked.