[PATCH v2] f2fs: fix to avoid page count leak

[PATCH v2] f2fs: fix to avoid page count leak

[Chao Yu]

In f2fs_read_data_pages(), once we add page into radix tree, we need to
release reference count of that page, however when f2fs_read_multi_pages()
fails, we didn't handle that case correctly, fix it.

Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Chao Yu <yuchao0@huawei.com>
---
v2:
- add Fixes tag
- improve commit message a bit
 fs/f2fs/compress.c | 2 +-
 fs/f2fs/data.c     | 6 +++++-
 fs/f2fs/f2fs.h     | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 498e0c2ba6ea..dbe3fa359a29 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -79,7 +79,7 @@ static void f2fs_drop_rpages(struct compress_ctx *cc, int len, bool unlock)
 	}
 }
 
-static void f2fs_put_rpages(struct compress_ctx *cc)
+void f2fs_put_rpages(struct compress_ctx *cc)
 {
 	f2fs_drop_rpages(cc, cc->cluster_size, false);
 }
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 1139d8cf4b8d..22a31e2401cf 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2138,7 +2138,7 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
 		} else if (!PageUptodate(page)) {
 			continue;
 		}
-		unlock_page(page);
+		f2fs_put_page(page, 1);
 		cc->rpages[i] = NULL;
 		cc->nr_rpages--;
 	}
@@ -2303,6 +2303,8 @@ int f2fs_mpage_readpages(struct address_space *mapping,
 							max_nr_pages,
 							&last_block_in_bio,
 							is_readahead, false);
+				if (ret)
+					f2fs_put_rpages(&cc);
 				f2fs_destroy_compress_ctx(&cc);
 				if (ret)
 					goto set_error_page;
@@ -2346,6 +2348,8 @@ int f2fs_mpage_readpages(struct address_space *mapping,
 							max_nr_pages,
 							&last_block_in_bio,
 							is_readahead, false);
+				if (ret)
+					f2fs_put_rpages(&cc);
 				f2fs_destroy_compress_ctx(&cc);
 			}
 		}
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index da5e9dd747fa..94d044feffd0 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3803,6 +3803,7 @@ static inline bool f2fs_post_read_required(struct inode *inode)
  */
 #ifdef CONFIG_F2FS_FS_COMPRESSION
 bool f2fs_is_compressed_page(struct page *page);
+void f2fs_put_rpages(struct compress_ctx *cc);
 struct page *f2fs_compress_control_page(struct page *page);
 int f2fs_prepare_compress_overwrite(struct inode *inode,
 			struct page **pagep, pgoff_t index, void **fsdata);
-- 
2.18.0.rc1

Re: [PATCH v2] f2fs: fix to avoid page count leak

[Chao Yu]

Hi Jaegeuk,

Let's drop this patch, I encounter bad page state (nonzero refcount) reported
by vm w/ this patch.

On 2020/4/15 10:13, Chao Yu wrote:
> In f2fs_read_data_pages(), once we add page into radix tree, we need to
> release reference count of that page, however when f2fs_read_multi_pages()
> fails, we didn't handle that case correctly, fix it.
> 
> Fixes: 4c8ff7095bef ("f2fs: support data compression")
> Signed-off-by: Chao Yu <yuchao0@huawei.com>

Re: [PATCH v2] f2fs: fix to avoid page count leak

[Jaegeuk Kim]

On 04/21, Chao Yu wrote:
> Hi Jaegeuk,
> 
> Let's drop this patch, I encounter bad page state (nonzero refcount) reported
> by vm w/ this patch.

Ok.

> 
> On 2020/4/15 10:13, Chao Yu wrote:
> > In f2fs_read_data_pages(), once we add page into radix tree, we need to
> > release reference count of that page, however when f2fs_read_multi_pages()
> > fails, we didn't handle that case correctly, fix it.
> > 
> > Fixes: 4c8ff7095bef ("f2fs: support data compression")
> > Signed-off-by: Chao Yu <yuchao0@huawei.com>