Commit 11de3b11 authored by Trond Myklebust's avatar Trond Myklebust
Browse files

NFS: Fix a memory leak in nfs_readdir 



We need to ensure that the entries in the nfs_cache_array get cleared
when the page is removed from the page cache. To do so, we use the
freepage address_space operation.

Change nfs_readdir_clear_array to use kmap_atomic(), so that the
function can be safely called from all contexts.

Finally, modify the cache_page_release helper to call
nfs_readdir_clear_array directly, when dealing with an anonymous
page from 'uncached_readdir'.

Signed-off-by: default avatarTrond Myklebust <Trond.Myklebust@netapp.com>
parent 6072d13c

fs/nfs/dir.c

+9 −9
Original line number Diff line number Diff line
@@ -57,7 +57,7 @@ static int nfs_rename(struct inode *, struct dentry *, 
		      struct inode *, struct dentry *);

static int nfs_fsync_dir(struct file *, int);

static loff_t nfs_llseek_dir(struct file *, loff_t, int);

static int nfs_readdir_clear_array(struct page*, gfp_t);

static void nfs_readdir_clear_array(struct page*);



const struct file_operations nfs_dir_operations = {

	.llseek		= nfs_llseek_dir,
@@ -83,8 +83,8 @@ const struct inode_operations nfs_dir_inode_operations = { 
	.setattr	= nfs_setattr,

};



const struct address_space_operations nfs_dir_addr_space_ops = {

	.releasepage = nfs_readdir_clear_array,

const struct address_space_operations nfs_dir_aops = {

	.freepage = nfs_readdir_clear_array,

};



#ifdef CONFIG_NFS_V3
@@ -214,17 +214,15 @@ void nfs_readdir_release_array(struct page *page) 
 * we are freeing strings created by nfs_add_to_readdir_array()

 */

static

int nfs_readdir_clear_array(struct page *page, gfp_t mask)

void nfs_readdir_clear_array(struct page *page)

{

	struct nfs_cache_array *array = nfs_readdir_get_array(page);

	struct nfs_cache_array *array;

	int i;



	if (IS_ERR(array))

		return PTR_ERR(array);

	array = kmap_atomic(page, KM_USER0);

	for (i = 0; i < array->size; i++)

		kfree(array->array[i].string.name);

	nfs_readdir_release_array(page);

	return 0;

	kunmap_atomic(array, KM_USER0);

}



/*
@@ -639,6 +637,8 @@ int nfs_readdir_filler(nfs_readdir_descriptor_t *desc, struct page* page) 
static

void cache_page_release(nfs_readdir_descriptor_t *desc)

{

	if (!desc->page->mapping)

		nfs_readdir_clear_array(desc->page);

	page_cache_release(desc->page);

	desc->page = NULL;

}

fs/nfs/inode.c

+1 −0
Original line number Diff line number Diff line
@@ -289,6 +289,7 @@ nfs_fhget(struct super_block *sb, struct nfs_fh *fh, struct nfs_fattr *fattr) 
		} else if (S_ISDIR(inode->i_mode)) {

			inode->i_op = NFS_SB(sb)->nfs_client->rpc_ops->dir_inode_ops;

			inode->i_fop = &nfs_dir_operations;

			inode->i_data.a_ops = &nfs_dir_aops;

			if (nfs_server_capable(inode, NFS_CAP_READDIRPLUS))

				set_bit(NFS_INO_ADVISE_RDPLUS, &NFS_I(inode)->flags);

			/* Deal with crossing mountpoints */

include/linux/nfs_fs.h

+1 −0
Original line number Diff line number Diff line
@@ -401,6 +401,7 @@ extern const struct inode_operations nfs3_file_inode_operations; 
#endif /* CONFIG_NFS_V3 */

extern const struct file_operations nfs_file_operations;

extern const struct address_space_operations nfs_file_aops;

extern const struct address_space_operations nfs_dir_aops;



static inline struct nfs_open_context *nfs_file_open_context(struct file *filp)

{

CRA Git | Maintained and supported by SUSTech CRA and CCSE