Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit be74fddc authored by Trond Myklebust's avatar Trond Myklebust Committed by Greg Kroah-Hartman
Browse files

NFS: Fix I/O request leakages 



commit f57dcf4c72113c745d83f1c65f7291299f65c14f upstream.

When we fail to add the request to the I/O queue, we currently leave it
to the caller to free the failed request. However since some of the
requests that fail are actually created by nfs_pageio_add_request()
itself, and are not passed back the caller, this leads to a leakage
issue, which can again cause page locks to leak.

This commit addresses the leakage by freeing the created requests on
error, using desc->pg_completion_ops->error_cleanup()

Signed-off-by: default avatarTrond Myklebust <trond.myklebust@hammerspace.com>
Fixes: a7d42ddb ("nfs: add mirroring support to pgio layer")
Cc: stable@vger.kernel.org # v4.0: c18b96a1: nfs: clean up rest of reqs
Cc: stable@vger.kernel.org # v4.0: d600ad1f: NFS41: pop some layoutget
Cc: stable@vger.kernel.org # v4.0+
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 4ea4f347

fs/nfs/pagelist.c

+21 −5
Original line number Diff line number Diff line
@@ -989,6 +989,17 @@ static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc) 
	}

}



static void

nfs_pageio_cleanup_request(struct nfs_pageio_descriptor *desc,

		struct nfs_page *req)

{

	LIST_HEAD(head);



	nfs_list_remove_request(req);

	nfs_list_add_request(req, &head);

	desc->pg_completion_ops->error_cleanup(&head);

}



/**

 * nfs_pageio_add_request - Attempt to coalesce a request into a page list.

 * @desc: destination io descriptor
@@ -1026,10 +1037,8 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, 
			nfs_page_group_unlock(req);

			desc->pg_moreio = 1;

			nfs_pageio_doio(desc);

			if (desc->pg_error < 0)

				return 0;

			if (mirror->pg_recoalesce)

				return 0;

			if (desc->pg_error < 0 || mirror->pg_recoalesce)

				goto out_cleanup_subreq;

			/* retry add_request for this subreq */

			nfs_page_group_lock(req);

			continue;
@@ -1062,6 +1071,10 @@ static int __nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, 
	desc->pg_error = PTR_ERR(subreq);

	nfs_page_group_unlock(req);

	return 0;

out_cleanup_subreq:

	if (req != subreq)

		nfs_pageio_cleanup_request(desc, subreq);

	return 0;

}



static int nfs_do_recoalesce(struct nfs_pageio_descriptor *desc)
@@ -1169,11 +1182,14 @@ int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc, 
		if (nfs_pgio_has_mirroring(desc))

			desc->pg_mirror_idx = midx;

		if (!nfs_pageio_add_request_mirror(desc, dupreq))

			goto out_failed;

			goto out_cleanup_subreq;

	}



	return 1;



out_cleanup_subreq:

	if (req != dupreq)

		nfs_pageio_cleanup_request(desc, dupreq);

out_failed:

	/* remember fatal errors */

	if (nfs_error_is_fatal(desc->pg_error))