[PATCH] zonefs: fix page reference and BIO leak

[PATCH] zonefs: fix page reference and BIO leak

[Damien Le Moal]

In zonefs_file_dio_append(), the pages obtained using
bio_iov_iter_get_pages() are not released on completion of the
REQ_OP_APPEND BIO and when bio_iov_iter_get_pages() fails. Fix this by
adding the missing calls to bio_release_pages() before returning.
Furthermore, a call to bio_put() is missing when
bio_iov_iter_get_pages() fails. Add it to avoid leaking the BIO
allocated. The call to bio_io_error() is removed from this error path
as the error code is returned directly to the caller.

Reported-by: Christoph Hellwig <hch@lst.de>
Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
---
 fs/zonefs/super.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index ff5930be096c..eb5d1db018e1 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -692,7 +692,8 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from)
 
 	ret = bio_iov_iter_get_pages(bio, from);
 	if (unlikely(ret)) {
-		bio_io_error(bio);
+		bio_release_pages(bio, false);
+		bio_put(bio);
 		return ret;
 	}
 	size = bio->bi_iter.bi_size;
@@ -703,6 +704,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from)
 
 	ret = submit_bio_wait(bio);
 
+	bio_release_pages(bio, false);
 	bio_put(bio);
 
 	zonefs_file_write_dio_end_io(iocb, size, ret, 0);
-- 
2.28.0

Re: [PATCH] zonefs: fix page reference and BIO leak

[Christoph Hellwig]

On Wed, Dec 09, 2020 at 08:37:38PM +0900, Damien Le Moal wrote:
> In zonefs_file_dio_append(), the pages obtained using
> bio_iov_iter_get_pages() are not released on completion of the
> REQ_OP_APPEND BIO and when bio_iov_iter_get_pages() fails. Fix this by
> adding the missing calls to bio_release_pages() before returning.
> Furthermore, a call to bio_put() is missing when
> bio_iov_iter_get_pages() fails. Add it to avoid leaking the BIO
> allocated. The call to bio_io_error() is removed from this error path
> as the error code is returned directly to the caller.
> 
> Reported-by: Christoph Hellwig <hch@lst.de>
> Fixes: 02ef12a663c7 ("zonefs: use REQ_OP_ZONE_APPEND for sync DIO")
> Cc: stable@vger.kernel.org
> Signed-off-by: Damien Le Moal <damien.lemoal@wdc.com>
> ---
>  fs/zonefs/super.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
> index ff5930be096c..eb5d1db018e1 100644
> --- a/fs/zonefs/super.c
> +++ b/fs/zonefs/super.c
> @@ -692,7 +692,8 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from)
>  
>  	ret = bio_iov_iter_get_pages(bio, from);
>  	if (unlikely(ret)) {
> -		bio_io_error(bio);
> +		bio_release_pages(bio, false);
> +		bio_put(bio);
>  		return ret;
>  	}
>  	size = bio->bi_iter.bi_size;
> @@ -703,6 +704,7 @@ static ssize_t zonefs_file_dio_append(struct kiocb *iocb, struct iov_iter *from)
>  
>  	ret = submit_bio_wait(bio);
>  
> +	bio_release_pages(bio, false);
>  	bio_put(bio);
>  
>  	zonefs_file_write_dio_end_io(iocb, size, ret, 0);

I think it might be a good idea to move the calls to bio_release_pages
and bio_put after zonefs_file_write_dio_end_io and then jump to them
from the above error case.  That keeps the resource unwinding in a
single place.