From: Steve French <smfrench@gmail.com>
To: jglisse@redhat.com
Cc: LKML <linux-kernel@vger.kernel.org>,
Steve French <sfrench@samba.org>,
CIFS <linux-cifs@vger.kernel.org>,
samba-technical <samba-technical@lists.samba.org>,
Alexander Viro <viro@zeniv.linux.org.uk>,
linux-fsdevel <linux-fsdevel@vger.kernel.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Stable <stable@vger.kernel.org>
Subject: Re: [PATCH] cifs: fix page reference leak with readv/writev
Date: Wed, 10 Apr 2019 21:47:01 -0500 [thread overview]
Message-ID: <CAH2r5ms-Y3FWhrabPEFt7T8MvC8Pwi1jjPFS7viWWRzx5rbVDw@mail.gmail.com> (raw)
In-Reply-To: <20190410193747.25302-1-jglisse@redhat.com>
How was this discovered? Does it address a reported user problem?
On Wed, Apr 10, 2019 at 2:38 PM <jglisse@redhat.com> wrote:
>
> From: Jérôme Glisse <jglisse@redhat.com>
>
> CIFS can leak pages reference gotten through GUP (get_user_pages*()
> through iov_iter_get_pages()). This happen if cifs_send_async_read()
> or cifs_write_from_iter() calls fail from within __cifs_readv() and
> __cifs_writev() respectively. This patch move page unreference to
> cifs_aio_ctx_release() which will happens on all code paths this is
> all simpler to follow for correctness.
>
> Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
> Cc: Steve French <sfrench@samba.org>
> Cc: linux-cifs@vger.kernel.org
> Cc: samba-technical@lists.samba.org
> Cc: Alexander Viro <viro@zeniv.linux.org.uk>
> Cc: linux-fsdevel@vger.kernel.org
> Cc: Linus Torvalds <torvalds@linux-foundation.org>
> Cc: Stable <stable@vger.kernel.org>
> ---
> fs/cifs/file.c | 15 +--------------
> fs/cifs/misc.c | 23 ++++++++++++++++++++++-
> 2 files changed, 23 insertions(+), 15 deletions(-)
>
> diff --git a/fs/cifs/file.c b/fs/cifs/file.c
> index 89006e044973..a756a4d3f70f 100644
> --- a/fs/cifs/file.c
> +++ b/fs/cifs/file.c
> @@ -2858,7 +2858,6 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
> struct cifs_tcon *tcon;
> struct cifs_sb_info *cifs_sb;
> struct dentry *dentry = ctx->cfile->dentry;
> - unsigned int i;
> int rc;
>
> tcon = tlink_tcon(ctx->cfile->tlink);
> @@ -2922,10 +2921,6 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
> kref_put(&wdata->refcount, cifs_uncached_writedata_release);
> }
>
> - if (!ctx->direct_io)
> - for (i = 0; i < ctx->npages; i++)
> - put_page(ctx->bv[i].bv_page);
> -
> cifs_stats_bytes_written(tcon, ctx->total_len);
> set_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(dentry->d_inode)->flags);
>
> @@ -3563,7 +3558,6 @@ collect_uncached_read_data(struct cifs_aio_ctx *ctx)
> struct iov_iter *to = &ctx->iter;
> struct cifs_sb_info *cifs_sb;
> struct cifs_tcon *tcon;
> - unsigned int i;
> int rc;
>
> tcon = tlink_tcon(ctx->cfile->tlink);
> @@ -3647,15 +3641,8 @@ collect_uncached_read_data(struct cifs_aio_ctx *ctx)
> kref_put(&rdata->refcount, cifs_uncached_readdata_release);
> }
>
> - if (!ctx->direct_io) {
> - for (i = 0; i < ctx->npages; i++) {
> - if (ctx->should_dirty)
> - set_page_dirty(ctx->bv[i].bv_page);
> - put_page(ctx->bv[i].bv_page);
> - }
> -
> + if (!ctx->direct_io)
> ctx->total_len = ctx->len - iov_iter_count(to);
> - }
>
> /* mask nodata case */
> if (rc == -ENODATA)
> diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
> index bee203055b30..9bc0d17a9d77 100644
> --- a/fs/cifs/misc.c
> +++ b/fs/cifs/misc.c
> @@ -768,6 +768,11 @@ cifs_aio_ctx_alloc(void)
> {
> struct cifs_aio_ctx *ctx;
>
> + /*
> + * Must use kzalloc to initialize ctx->bv to NULL and ctx->direct_io
> + * to false so that we know when we have to unreference pages within
> + * cifs_aio_ctx_release()
> + */
> ctx = kzalloc(sizeof(struct cifs_aio_ctx), GFP_KERNEL);
> if (!ctx)
> return NULL;
> @@ -786,7 +791,23 @@ cifs_aio_ctx_release(struct kref *refcount)
> struct cifs_aio_ctx, refcount);
>
> cifsFileInfo_put(ctx->cfile);
> - kvfree(ctx->bv);
> +
> + /*
> + * ctx->bv is only set if setup_aio_ctx_iter() was call successfuly
> + * which means that iov_iter_get_pages() was a success and thus that
> + * we have taken reference on pages.
> + */
> + if (ctx->bv) {
> + unsigned i;
> +
> + for (i = 0; i < ctx->npages; i++) {
> + if (ctx->should_dirty)
> + set_page_dirty(ctx->bv[i].bv_page);
> + put_page(ctx->bv[i].bv_page);
> + }
> + kvfree(ctx->bv);
> + }
> +
> kfree(ctx);
> }
>
> --
> 2.20.1
>
--
Thanks,
Steve
next prev parent reply other threads:[~2019-04-11 2:47 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-04-10 19:37 [PATCH] cifs: fix page reference leak with readv/writev jglisse
2019-04-11 2:47 ` Steve French [this message]
2019-04-18 21:12 ` Jerome Glisse
2019-04-18 21:45 ` Pavel Shilovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAH2r5ms-Y3FWhrabPEFt7T8MvC8Pwi1jjPFS7viWWRzx5rbVDw@mail.gmail.com \
--to=smfrench@gmail.com \
--cc=jglisse@redhat.com \
--cc=linux-cifs@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=samba-technical@lists.samba.org \
--cc=sfrench@samba.org \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).