cifs: fix page reference leak with readv/writev [Linux 5.1]

cifs: fix page reference leak with readv/writev [Linux 5.1]

This Linux kernel change "cifs: fix page reference leak with readv/writev" is included in the Linux 5.1 release. This change is authored by Jérôme Glisse <jglisse [at] redhat.com> on Wed Apr 10 15:37:47 2019 -0400. The commit for this change in Linux stable tree is 13f5938 (patch).

cifs: fix page reference leak with readv/writev

CIFS can leak pages reference gotten through GUP (get_user_pages*()
through iov_iter_get_pages()). This happen if cifs_send_async_read()
or cifs_write_from_iter() calls fail from within __cifs_readv() and
__cifs_writev() respectively. This patch move page unreference to
cifs_aio_ctx_release() which will happens on all code paths this is
all simpler to follow for correctness.

Signed-off-by: Jérôme Glisse <[email protected]>
Cc: Steve French <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Alexander Viro <[email protected]>
Cc: [email protected]
Cc: Linus Torvalds <[email protected]>
Cc: Stable <[email protected]>
Signed-off-by: Steve French <[email protected]>
Reviewed-by: Pavel Shilovsky <[email protected]>

There are 38 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 fs/cifs/file.c | 15 +--------------
 fs/cifs/misc.c | 23 ++++++++++++++++++++++-
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 9c0ccc0..7037a13 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -2877,7 +2877,6 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
    struct cifs_tcon *tcon;
    struct cifs_sb_info *cifs_sb;
    struct dentry *dentry = ctx->cfile->dentry;
-   unsigned int i;
    int rc;

    tcon = tlink_tcon(ctx->cfile->tlink);
@@ -2941,10 +2940,6 @@ static void collect_uncached_write_data(struct cifs_aio_ctx *ctx)
        kref_put(&wdata->refcount, cifs_uncached_writedata_release);
    }

-   if (!ctx->direct_io)
-       for (i = 0; i < ctx->npages; i++)
-           put_page(ctx->bv[i].bv_page);
-
    cifs_stats_bytes_written(tcon, ctx->total_len);
    set_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(dentry->d_inode)->flags);

@@ -3582,7 +3577,6 @@ static int cifs_resend_rdata(struct cifs_readdata *rdata,
    struct iov_iter *to = &ctx->iter;
    struct cifs_sb_info *cifs_sb;
    struct cifs_tcon *tcon;
-   unsigned int i;
    int rc;

    tcon = tlink_tcon(ctx->cfile->tlink);
@@ -3666,15 +3660,8 @@ static int cifs_resend_rdata(struct cifs_readdata *rdata,
        kref_put(&rdata->refcount, cifs_uncached_readdata_release);
    }

-   if (!ctx->direct_io) {
-       for (i = 0; i < ctx->npages; i++) {
-           if (ctx->should_dirty)
-               set_page_dirty(ctx->bv[i].bv_page);
-           put_page(ctx->bv[i].bv_page);
-       }
-
+   if (!ctx->direct_io)
        ctx->total_len = ctx->len - iov_iter_count(to);
-   }

    /* mask nodata case */
    if (rc == -ENODATA)
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1e1626a..0dc6f08 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -789,6 +789,11 @@ struct cifs_aio_ctx *
 {
    struct cifs_aio_ctx *ctx;

+   /*
+    * Must use kzalloc to initialize ctx->bv to NULL and ctx->direct_io
+    * to false so that we know when we have to unreference pages within
+    * cifs_aio_ctx_release()
+    */
    ctx = kzalloc(sizeof(struct cifs_aio_ctx), GFP_KERNEL);
    if (!ctx)
        return NULL;
@@ -807,7 +812,23 @@ struct cifs_aio_ctx *
                    struct cifs_aio_ctx, refcount);

    cifsFileInfo_put(ctx->cfile);
-   kvfree(ctx->bv);
+
+   /*
+    * ctx->bv is only set if setup_aio_ctx_iter() was call successfuly
+    * which means that iov_iter_get_pages() was a success and thus that
+    * we have taken reference on pages.
+    */
+   if (ctx->bv) {
+       unsigned i;
+
+       for (i = 0; i < ctx->npages; i++) {
+           if (ctx->should_dirty)
+               set_page_dirty(ctx->bv[i].bv_page);
+           put_page(ctx->bv[i].bv_page);
+       }
+       kvfree(ctx->bv);
+   }
+
    kfree(ctx);
 }

Leave a Reply

Your email address will not be published. Required fields are marked *