Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <20190410193747.25302-1-jglisse@redhat.com> <CAH2r5ms-Y3FWhrabPEFt7T8MvC8Pwi1jjPFS7viWWRzx5rbVDw@mail.gmail.com>
 <20190418211226.GO3288@redhat.com> <CAKywueS_A9zSnDtEJ-m8yV_AWzpAF_s-gp_HMDhFhM2J1QkiTw@mail.gmail.com>
In-Reply-To: <CAKywueS_A9zSnDtEJ-m8yV_AWzpAF_s-gp_HMDhFhM2J1QkiTw@mail.gmail.com>
From:   Steve French <smfrench@gmail.com>
Date:   Sat, 20 Apr 2019 22:48:29 -0500
Message-ID: <CAH2r5msNLx_6jQ_TgFAx4DY5TNd=SMTNuNYHGmgoFFreqUKF8Q@mail.gmail.com>
Subject: Re: [PATCH] cifs: fix page reference leak with readv/writev
To:     Pavel Shilovsky <piastryyy@gmail.com>
Cc:     Jerome Glisse <jglisse@redhat.com>,
        LKML <linux-kernel@vger.kernel.org>,
        CIFS <linux-cifs@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

updated patch in cifs-2.6.git for-next

On Thu, Apr 18, 2019 at 4:45 PM Pavel Shilovsky <piastryyy@gmail.com> wrote=
:
>
> =D1=87=D1=82, 18 =D0=B0=D0=BF=D1=80. 2019 =D0=B3. =D0=B2 14:12, Jerome Gl=
isse <jglisse@redhat.com>:
> >
> > On Wed, Apr 10, 2019 at 09:47:01PM -0500, Steve French wrote:
> > > How was this discovered? Does it address a reported user problem?
> >
> > I have spotted it while tracking down how page reference are taken
> > for bio and how they are release. In the current code, once the page
> > are GUPed they are never release if there is any failure, on failure
> > cifs_aio_ctx_release() will be call but it will just free the bio_vec
> > not release the page reference.
> >
> > Page reference are only drop if everything is successful.
> >
> > So this patch move the page reference droping to cifs_aio_ctx_release()
> > which is call from all code path including failure AFAICT and thus page
> > reference will be drop if failure does happen.
> >
> > Cheers,
> > J=C3=A9r=C3=B4me
> >
> > >
> > > On Wed, Apr 10, 2019 at 2:38 PM <jglisse@redhat.com> wrote:
> > > >
> > > > From: J=C3=A9r=C3=B4me Glisse <jglisse@redhat.com>
> > > >
> > > > CIFS can leak pages reference gotten through GUP (get_user_pages*()
> > > > through iov_iter_get_pages()). This happen if cifs_send_async_read(=
)
> > > > or cifs_write_from_iter() calls fail from within __cifs_readv() and
> > > > __cifs_writev() respectively. This patch move page unreference to
> > > > cifs_aio_ctx_release() which will happens on all code paths this is
> > > > all simpler to follow for correctness.
> > > >
> > > > Signed-off-by: J=C3=A9r=C3=B4me Glisse <jglisse@redhat.com>
> > > > Cc: Steve French <sfrench@samba.org>
> > > > Cc: linux-cifs@vger.kernel.org
> > > > Cc: samba-technical@lists.samba.org
> > > > Cc: Alexander Viro <viro@zeniv.linux.org.uk>
> > > > Cc: linux-fsdevel@vger.kernel.org
> > > > Cc: Linus Torvalds <torvalds@linux-foundation.org>
> > > > Cc: Stable <stable@vger.kernel.org>
> > > > ---
> > > >  fs/cifs/file.c | 15 +--------------
> > > >  fs/cifs/misc.c | 23 ++++++++++++++++++++++-
> > > >  2 files changed, 23 insertions(+), 15 deletions(-)
> > > >
> > > > diff --git a/fs/cifs/file.c b/fs/cifs/file.c
> > > > index 89006e044973..a756a4d3f70f 100644
> > > > --- a/fs/cifs/file.c
> > > > +++ b/fs/cifs/file.c
> > > > @@ -2858,7 +2858,6 @@ static void collect_uncached_write_data(struc=
t cifs_aio_ctx *ctx)
> > > >         struct cifs_tcon *tcon;
> > > >         struct cifs_sb_info *cifs_sb;
> > > >         struct dentry *dentry =3D ctx->cfile->dentry;
> > > > -       unsigned int i;
> > > >         int rc;
> > > >
> > > >         tcon =3D tlink_tcon(ctx->cfile->tlink);
> > > > @@ -2922,10 +2921,6 @@ static void collect_uncached_write_data(stru=
ct cifs_aio_ctx *ctx)
> > > >                 kref_put(&wdata->refcount, cifs_uncached_writedata_=
release);
> > > >         }
> > > >
> > > > -       if (!ctx->direct_io)
> > > > -               for (i =3D 0; i < ctx->npages; i++)
> > > > -                       put_page(ctx->bv[i].bv_page);
> > > > -
> > > >         cifs_stats_bytes_written(tcon, ctx->total_len);
> > > >         set_bit(CIFS_INO_INVALID_MAPPING, &CIFS_I(dentry->d_inode)-=
>flags);
> > > >
> > > > @@ -3563,7 +3558,6 @@ collect_uncached_read_data(struct cifs_aio_ct=
x *ctx)
> > > >         struct iov_iter *to =3D &ctx->iter;
> > > >         struct cifs_sb_info *cifs_sb;
> > > >         struct cifs_tcon *tcon;
> > > > -       unsigned int i;
> > > >         int rc;
> > > >
> > > >         tcon =3D tlink_tcon(ctx->cfile->tlink);
> > > > @@ -3647,15 +3641,8 @@ collect_uncached_read_data(struct cifs_aio_c=
tx *ctx)
> > > >                 kref_put(&rdata->refcount, cifs_uncached_readdata_r=
elease);
> > > >         }
> > > >
> > > > -       if (!ctx->direct_io) {
> > > > -               for (i =3D 0; i < ctx->npages; i++) {
> > > > -                       if (ctx->should_dirty)
> > > > -                               set_page_dirty(ctx->bv[i].bv_page);
> > > > -                       put_page(ctx->bv[i].bv_page);
> > > > -               }
> > > > -
> > > > +       if (!ctx->direct_io)
> > > >                 ctx->total_len =3D ctx->len - iov_iter_count(to);
> > > > -       }
> > > >
> > > >         /* mask nodata case */
> > > >         if (rc =3D=3D -ENODATA)
> > > > diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
> > > > index bee203055b30..9bc0d17a9d77 100644
> > > > --- a/fs/cifs/misc.c
> > > > +++ b/fs/cifs/misc.c
> > > > @@ -768,6 +768,11 @@ cifs_aio_ctx_alloc(void)
> > > >  {
> > > >         struct cifs_aio_ctx *ctx;
> > > >
> > > > +       /*
> > > > +        * Must use kzalloc to initialize ctx->bv to NULL and ctx->=
direct_io
> > > > +        * to false so that we know when we have to unreference pag=
es within
> > > > +        * cifs_aio_ctx_release()
> > > > +        */
> > > >         ctx =3D kzalloc(sizeof(struct cifs_aio_ctx), GFP_KERNEL);
> > > >         if (!ctx)
> > > >                 return NULL;
> > > > @@ -786,7 +791,23 @@ cifs_aio_ctx_release(struct kref *refcount)
> > > >                                         struct cifs_aio_ctx, refcou=
nt);
> > > >
> > > >         cifsFileInfo_put(ctx->cfile);
> > > > -       kvfree(ctx->bv);
> > > > +
> > > > +       /*
> > > > +        * ctx->bv is only set if setup_aio_ctx_iter() was call suc=
cessfuly
> > > > +        * which means that iov_iter_get_pages() was a success and =
thus that
> > > > +        * we have taken reference on pages.
> > > > +        */
> > > > +       if (ctx->bv) {
> > > > +               unsigned i;
> > > > +
> > > > +               for (i =3D 0; i < ctx->npages; i++) {
> > > > +                       if (ctx->should_dirty)
> > > > +                               set_page_dirty(ctx->bv[i].bv_page);
> > > > +                       put_page(ctx->bv[i].bv_page);
> > > > +               }
> > > > +               kvfree(ctx->bv);
> > > > +       }
> > > > +
> > > >         kfree(ctx);
> > > >  }
> > > >
> > > > --
> > > > 2.20.1
> > > >
>
> Good catch, thanks!
>
> Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>
>
> --
> Best regards,
> Pavel Shilovsky


--=20
Thanks,

Steve