Received: by 2002:ad5:474a:0:0:0:0:0 with SMTP id i10csp2022857imu; Fri, 14 Dec 2018 04:39:49 -0800 (PST) X-Google-Smtp-Source: AFSGD/XrmWn/r5Ec45Vo64I1rFQ/C+HkzKchG35mfkcIVB8HMvmUbFaIT54dR/CblONiDjZzhVS2 X-Received: by 2002:a63:89c2:: with SMTP id v185mr2376391pgd.97.1544791189513; Fri, 14 Dec 2018 04:39:49 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1544791189; cv=none; d=google.com; s=arc-20160816; b=tyjUpsX2jMgC35c68jXAuMY8b1JBpmOnAwZx4jnapE4jczSASsMdLW7tgE5Q+HITss I4kLGbUFyJrSkgGrBEIVF2ffcpBvs8DIpEovnC/0VO2FDF6uYnthLvatnsO4yktyn0qI NlXywM1+unHE/FUDji2GUlF6CCccRTBPBnElshk59YFrC7XpQsFWKe8CBs+GFjiVFD5P aTW8nLNAi9ayjlT8W7YLEm0TUeQRu6/SbT9PPjczmpXwJvSh5lkcOsJu10yV52w98QaO EMKIn9OOkKnomkrsfc6p2IYZxa2uVjTb6yyNCJyeBfoZ7zQLMtu3tl4/qWVOzJSIHL2v gIww== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=yJHorJKIVqfIZnu6b/GbqW68HJB6aUvrLIZVGJffcRg=; b=XUbSEShz7lEnuuIZTI6lY/8JWrCBLSf9dUUuG16Q+O70FczPkKfY8nqe8vdryxJQPR Zuejua1GdBrnQ/qzygb76jmKDotMzm52iHm/XRi8ZsAMQoGJlPalvO8wOLrFTIVyAPxl pA/pCgVQd9/4NrkvU1LyMjKjBmtrXiOU/TLmk0QWsGxMhEu5jniGAQzbDOUXo+tGkDxp NycTCCt32KAnGJqkbW4opLsXQdFXuO6bI0Lc2tjTNz/4G0vYHzZrJ5yHsDq3xz9RvrDU o9OTAbCQmFRQl0n7Sw/V/2pKZumIvXlwgGTkunM/mTl7rjnXMKSr+ZRlos8ra5+Ek7HG B0Cw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=mt4YNFZn; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id be11si3864436plb.134.2018.12.14.04.39.34; Fri, 14 Dec 2018 04:39:49 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=mt4YNFZn; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1730721AbeLNMFd (ORCPT + 99 others); Fri, 14 Dec 2018 07:05:33 -0500 Received: from mail.kernel.org ([198.145.29.99]:50374 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1730207AbeLNMFb (ORCPT ); Fri, 14 Dec 2018 07:05:31 -0500 Received: from localhost (5356596B.cm-6-7b.dynamic.ziggo.nl [83.86.89.107]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 26B15214AE; Fri, 14 Dec 2018 12:05:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1544789130; bh=Z5vKT/Ep4xs7jSGva5F4sz9QjugI5zZfWMnMMjhKBxg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mt4YNFZn6Qs7tImcKjNwxS2X/TBndwi//XCwiV5ys24Ls5Zo2DDBrD8HzmZ8ACcEo vExBf7fR1JMi15b/9yN7VSSD/wycQfynH30MpCHqQoN3XR+orW5ND/7pT81JhZOXNC RWOFGuGSw/1ZCWhLTCdx0vTIo0hPn14/r+0JFIE8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Axtens , Shantanu Goel , Kiran Kumar Modukuri , David Howells , Sasha Levin Subject: [PATCH 4.19 106/142] cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active Date: Fri, 14 Dec 2018 12:59:51 +0100 Message-Id: <20181214115751.294555259@linuxfoundation.org> X-Mailer: git-send-email 2.20.0 In-Reply-To: <20181214115747.053633987@linuxfoundation.org> References: <20181214115747.053633987@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.19-stable review patch. If anyone has any objections, please let me know. ------------------ [ Upstream commit 9a24ce5b66f9c8190d63b15f4473600db4935f1f ] [Description] In a heavily loaded system where the system pagecache is nearing memory limits and fscache is enabled, pages can be leaked by fscache while trying read pages from cachefiles backend. This can happen because two applications can be reading same page from a single mount, two threads can be trying to read the backing page at same time. This results in one of the threads finding that a page for the backing file or netfs file is already in the radix tree. During the error handling cachefiles does not clean up the reference on backing page, leading to page leak. [Fix] The fix is straightforward, to decrement the reference when error is encountered. [dhowells: Note that I've removed the clearance and put of newpage as they aren't attested in the commit message and don't appear to actually achieve anything since a new page is only allocated is newpage!=NULL and any residual new page is cleared before returning.] [Testing] I have tested the fix using following method for 12+ hrs. 1) mkdir -p /mnt/nfs ; mount -o vers=3,fsc :/export /mnt/nfs 2) create 10000 files of 2.8MB in a NFS mount. 3) start a thread to simulate heavy VM presssure (while true ; do echo 3 > /proc/sys/vm/drop_caches ; sleep 1 ; done)& 4) start multiple parallel reader for data set at same time find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & .. .. find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & find /mnt/nfs -type f | xargs -P 80 cat > /dev/null & 5) finally check using cat /proc/fs/fscache/stats | grep -i pages ; free -h , cat /proc/meminfo and page-types -r -b lru to ensure all pages are freed. Reviewed-by: Daniel Axtens Signed-off-by: Shantanu Goel Signed-off-by: Kiran Kumar Modukuri [dja: forward ported to current upstream] Signed-off-by: Daniel Axtens Signed-off-by: David Howells Signed-off-by: Sasha Levin --- fs/cachefiles/rdwr.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c index 40f7595aad10..db233588a69a 100644 --- a/fs/cachefiles/rdwr.c +++ b/fs/cachefiles/rdwr.c @@ -535,7 +535,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object, netpage->index, cachefiles_gfp); if (ret < 0) { if (ret == -EEXIST) { + put_page(backpage); + backpage = NULL; put_page(netpage); + netpage = NULL; fscache_retrieval_complete(op, 1); continue; } @@ -608,7 +611,10 @@ static int cachefiles_read_backing_file(struct cachefiles_object *object, netpage->index, cachefiles_gfp); if (ret < 0) { if (ret == -EEXIST) { + put_page(backpage); + backpage = NULL; put_page(netpage); + netpage = NULL; fscache_retrieval_complete(op, 1); continue; } -- 2.19.1