leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

NFS: Directory page cache pages need to be locked when read

Browse Source 
When a NFS directory page cache page is removed from the page cache,
its contents are freed through a call to nfs_readdir_clear_array().
To prevent the removal of the page cache entry until after we've
finished reading it, we must take the page lock.

Fixes: 11de3b11e0 ("NFS: Fix a memory leak in nfs_readdir")
Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
This commit is contained in:
Trond Myklebust
2020-02-02 17:53:54 -05:00
committed by Anna Schumaker
parent 4b310319c6
commit 114de38225
1 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
fs/nfs/dir.c
View File

@@ -702,8 +702,6 @@ int nfs_readdir_filler(void *data, struct page* page)
static static
void cache_page_release(nfs_readdir_descriptor_t *desc) void cache_page_release(nfs_readdir_descriptor_t *desc)
{ {
if (!desc->page->mapping)
nfs_readdir_clear_array(desc->page);
put_page(desc->page); put_page(desc->page);
desc->page = NULL; desc->page = NULL;
} }
@@ -717,18 +715,27 @@ struct page *get_cache_page(nfs_readdir_descriptor_t *desc)
/* /*
* Returns 0 if desc->dir_cookie was found on page desc->page_index * Returns 0 if desc->dir_cookie was found on page desc->page_index
* and locks the page to prevent removal from the page cache.
*/ */
static static
int find_cache_page(nfs_readdir_descriptor_t *desc) int find_and_lock_cache_page(nfs_readdir_descriptor_t *desc)
{ {
int res; int res;
desc->page = get_cache_page(desc); desc->page = get_cache_page(desc);
if (IS_ERR(desc->page)) if (IS_ERR(desc->page))
return PTR_ERR(desc->page); return PTR_ERR(desc->page);
res = lock_page_killable(desc->page);
res = nfs_readdir_search_array(desc);
if (res != 0) if (res != 0)
goto error;
res = -EAGAIN;
if (desc->page->mapping != NULL) {
res = nfs_readdir_search_array(desc);
if (res == 0)
return 0;
}
unlock_page(desc->page);
error:
cache_page_release(desc); cache_page_release(desc);
return res; return res;
} }
@@ -744,7 +751,7 @@ int readdir_search_pagecache(nfs_readdir_descriptor_t *desc)
desc->last_cookie = 0; desc->last_cookie = 0;
} }
do { do {
res = find_cache_page(desc); res = find_and_lock_cache_page(desc);
} while (res == -EAGAIN); } while (res == -EAGAIN);
return res; return res;
} }
@@ -783,7 +790,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc)
desc->eof = true; desc->eof = true;
kunmap(desc->page); kunmap(desc->page);
cache_page_release(desc);
dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n", dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
(unsigned long long)*desc->dir_cookie, res); (unsigned long long)*desc->dir_cookie, res);
return res; return res;
@@ -829,13 +835,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc)
status = nfs_do_filldir(desc); status = nfs_do_filldir(desc);
out_release:
nfs_readdir_clear_array(desc->page);
cache_page_release(desc);
out: out:
dfprintk(DIRCACHE, "NFS: %s: returns %d\n", dfprintk(DIRCACHE, "NFS: %s: returns %d\n",
__func__, status); __func__, status);
return status; return status;
out_release:
cache_page_release(desc);
goto out;
} }
/* The file offset position represents the dirent entry number. A /* The file offset position represents the dirent entry number. A
@@ -900,6 +906,8 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
break; break;
res = nfs_do_filldir(desc); res = nfs_do_filldir(desc);
unlock_page(desc->page);
cache_page_release(desc);
if (res < 0) if (res < 0)
break; break;
} while (!desc->eof); } while (!desc->eof);