NFS: Directory page cache pages need to be locked when read
commit5.4-rM2-2.2.x-imx-squashed114de38225
upstream. When a NFS directory page cache page is removed from the page cache, its contents are freed through a call to nfs_readdir_clear_array(). To prevent the removal of the page cache entry until after we've finished reading it, we must take the page lock. Fixes:11de3b11e0
("NFS: Fix a memory leak in nfs_readdir") Cc: stable@vger.kernel.org # v2.6.37+ Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Reviewed-by: Benjamin Coddington <bcodding@redhat.com> Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
293cdcd89b
commit
4544a69124
30
fs/nfs/dir.c
30
fs/nfs/dir.c
|
@ -702,8 +702,6 @@ int nfs_readdir_filler(void *data, struct page* page)
|
||||||
static
|
static
|
||||||
void cache_page_release(nfs_readdir_descriptor_t *desc)
|
void cache_page_release(nfs_readdir_descriptor_t *desc)
|
||||||
{
|
{
|
||||||
if (!desc->page->mapping)
|
|
||||||
nfs_readdir_clear_array(desc->page);
|
|
||||||
put_page(desc->page);
|
put_page(desc->page);
|
||||||
desc->page = NULL;
|
desc->page = NULL;
|
||||||
}
|
}
|
||||||
|
@ -717,19 +715,28 @@ struct page *get_cache_page(nfs_readdir_descriptor_t *desc)
|
||||||
|
|
||||||
/*
|
/*
|
||||||
* Returns 0 if desc->dir_cookie was found on page desc->page_index
|
* Returns 0 if desc->dir_cookie was found on page desc->page_index
|
||||||
|
* and locks the page to prevent removal from the page cache.
|
||||||
*/
|
*/
|
||||||
static
|
static
|
||||||
int find_cache_page(nfs_readdir_descriptor_t *desc)
|
int find_and_lock_cache_page(nfs_readdir_descriptor_t *desc)
|
||||||
{
|
{
|
||||||
int res;
|
int res;
|
||||||
|
|
||||||
desc->page = get_cache_page(desc);
|
desc->page = get_cache_page(desc);
|
||||||
if (IS_ERR(desc->page))
|
if (IS_ERR(desc->page))
|
||||||
return PTR_ERR(desc->page);
|
return PTR_ERR(desc->page);
|
||||||
|
res = lock_page_killable(desc->page);
|
||||||
res = nfs_readdir_search_array(desc);
|
|
||||||
if (res != 0)
|
if (res != 0)
|
||||||
cache_page_release(desc);
|
goto error;
|
||||||
|
res = -EAGAIN;
|
||||||
|
if (desc->page->mapping != NULL) {
|
||||||
|
res = nfs_readdir_search_array(desc);
|
||||||
|
if (res == 0)
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
unlock_page(desc->page);
|
||||||
|
error:
|
||||||
|
cache_page_release(desc);
|
||||||
return res;
|
return res;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -744,7 +751,7 @@ int readdir_search_pagecache(nfs_readdir_descriptor_t *desc)
|
||||||
desc->last_cookie = 0;
|
desc->last_cookie = 0;
|
||||||
}
|
}
|
||||||
do {
|
do {
|
||||||
res = find_cache_page(desc);
|
res = find_and_lock_cache_page(desc);
|
||||||
} while (res == -EAGAIN);
|
} while (res == -EAGAIN);
|
||||||
return res;
|
return res;
|
||||||
}
|
}
|
||||||
|
@ -783,7 +790,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc)
|
||||||
desc->eof = true;
|
desc->eof = true;
|
||||||
|
|
||||||
kunmap(desc->page);
|
kunmap(desc->page);
|
||||||
cache_page_release(desc);
|
|
||||||
dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
|
dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
|
||||||
(unsigned long long)*desc->dir_cookie, res);
|
(unsigned long long)*desc->dir_cookie, res);
|
||||||
return res;
|
return res;
|
||||||
|
@ -829,13 +835,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc)
|
||||||
|
|
||||||
status = nfs_do_filldir(desc);
|
status = nfs_do_filldir(desc);
|
||||||
|
|
||||||
|
out_release:
|
||||||
|
nfs_readdir_clear_array(desc->page);
|
||||||
|
cache_page_release(desc);
|
||||||
out:
|
out:
|
||||||
dfprintk(DIRCACHE, "NFS: %s: returns %d\n",
|
dfprintk(DIRCACHE, "NFS: %s: returns %d\n",
|
||||||
__func__, status);
|
__func__, status);
|
||||||
return status;
|
return status;
|
||||||
out_release:
|
|
||||||
cache_page_release(desc);
|
|
||||||
goto out;
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/* The file offset position represents the dirent entry number. A
|
/* The file offset position represents the dirent entry number. A
|
||||||
|
@ -900,6 +906,8 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
|
||||||
break;
|
break;
|
||||||
|
|
||||||
res = nfs_do_filldir(desc);
|
res = nfs_do_filldir(desc);
|
||||||
|
unlock_page(desc->page);
|
||||||
|
cache_page_release(desc);
|
||||||
if (res < 0)
|
if (res < 0)
|
||||||
break;
|
break;
|
||||||
} while (!desc->eof);
|
} while (!desc->eof);
|
||||||
|
|
Loading…
Reference in New Issue