David Howells 71562809e4 cifs: Fix memory leak in direct I/O ... When __cifs_readv() and __cifs_writev() extract pages from a user-backed iterator into a BVEC-type iterator, they set ->bv_need_unpin to note whether they need to unpin the pages later. However, in both cases they examine the BVEC-type iterator and not the source iterator - and so bv_need_unpin doesn't get set and the pages are leaked. I think this may be responsible for the generic/208 xfstest failing occasionally with: WARNING: CPU: 0 PID: 3064 at mm/gup.c:218 try_grab_page+0x65/0x100 RIP: 0010:try_grab_page+0x65/0x100 follow_page_pte+0x1a7/0x570 __get_user_pages+0x1a2/0x650 __gup_longterm_locked+0xdc/0xb50 internal_get_user_pages_fast+0x17f/0x310 pin_user_pages_fast+0x46/0x60 iov_iter_extract_pages+0xc9/0x510 ? __kmalloc_large_node+0xb1/0x120 ? __kmalloc_node+0xbe/0x130 netfs_extract_user_iter+0xbf/0x200 [netfs] __cifs_writev+0x150/0x330 [cifs] vfs_write+0x2a8/0x3c0 ksys_pwrite64+0x65/0xa0 with the page refcount going negative. This is less unlikely than it seems because the page is being pinned, not simply got, and so the refcount increased by 1024 each time, and so only needs to be called around ~2097152 for the refcount to go negative. Further, the test program (aio-dio-invalidate-failure) uses a 32MiB static buffer and all the PTEs covering it refer to the same page because it's never written to. The warning in try_grab_page(): if (WARN_ON_ONCE(folio_ref_count(folio) <= 0)) return -ENOMEM; then trips and prevents us ever using the page again for DIO at least. Fixes: d08089f649 ("cifs: Change the I/O paths to use an iterator rather than a page list") Reported-by: Murphy Zhou <jencce.kernel@gmail.com> Link: https://lore.kernel.org/r/CAH2r5mvaTsJ---n=265a4zqRA7pP+o4MJ36WCQUS6oPrOij8cw@mail.gmail.com Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Paulo Alcantara (SUSE) <pc@manguebit.com> cc: Shyam Prasad N <nspmangalore@gmail.com> cc: Rohith Surabattula <rohiths.msft@gmail.com> cc: Jeff Layton <jlayton@kernel.org> cc: linux-cifs@vger.kernel.org Signed-off-by: Steve French <stfrench@microsoft.com>		2023-03-01 18:18:25 -06:00
..
9p	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
adfs	fs: port ->setattr() to pass mnt_idmap	2023-01-19 09:24:02 +01:00
affs	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
afs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
autofs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
befs
bfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
btrfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
cachefiles	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ceph	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
cifs	cifs: Fix memory leak in direct I/O	2023-03-01 18:18:25 -06:00
coda	hardening updates for v6.3-rc1	2023-02-21 11:07:23 -08:00
configfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
cramfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
crypto	fsverity updates for 6.3	2023-02-20 12:33:41 -08:00
debugfs	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
devpts
dlm	Networking changes for 6.3.	2023-02-21 18:24:12 -08:00
ecryptfs	This update includes the following changes:	2023-02-21 18:10:50 -08:00
efivarfs	A healthy mix of EFI contributions this time:	2023-02-23 14:41:48 -08:00
efs
erofs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
exfat	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
exportfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
ext2	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
ext4	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
f2fs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
fat	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
freevxfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
fscache	fscache: Use clear_and_wake_up_bit() in fscache_create_volume_work()	2023-01-30 12:51:54 +00:00
fuse	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
gfs2	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
hfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
hfsplus	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
hostfs	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
hpfs	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
hugetlbfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
iomap	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
isofs	- hfs and hfsplus kmap API modernization from Fabio Francesco	2022-10-12 11:00:22 -07:00
jbd2	jbd2,ocfs2: move jbd2_journal_submit_inode_data_buffers to ocfs2	2023-01-18 17:12:51 -08:00
jffs2	fs: port acl to mnt_idmap	2023-01-19 09:24:28 +01:00
jfs	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
kernfs	fs: port xattr to mnt_idmap	2023-01-19 09:24:28 +01:00
ksmbd	46 fs/cifs (smb3 client) changesets, 37 in fs/cifs and 9 for related helper functions and cleanup outside from Dave Howells and Willy	2023-02-22 17:12:44 -08:00
lockd	sysctl-6.3-rc1	2023-02-23 14:16:56 -08:00
minix	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
netfs	iov: Fix netfs_extract_user_to_sg()	2023-03-01 18:18:25 -06:00
nfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
nfs_common	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
nfsd	NFSD 6.3 Release Notes	2023-02-22 14:21:40 -08:00
nilfs2	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
nls
notify	RCU pull request for v6.3	2023-02-21 10:45:51 -08:00
ntfs	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
ntfs3	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
ocfs2	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
omfs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
openpromfs
orangefs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
overlayfs	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
proc	There is no particular theme here - mainly quick hits all over the tree.	2023-02-23 17:55:40 -08:00
pstore	pstore updates for v6.2-rc1-fixes	2022-12-23 11:55:54 -08:00
qnx4
qnx6
quota	RCU pull request for v6.3	2023-02-21 10:45:51 -08:00
ramfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
reiserfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
romfs	mm/nommu: factor out check for NOMMU shared mappings into is_nommu_shared_mapping()	2023-01-18 17:12:56 -08:00
smbfs_common	smb3: Replace smb2pdu 1-element arrays with flex-arrays	2023-02-20 17:25:43 -06:00
squashfs	revert "squashfs: harden sanity check in squashfs_read_xattr_id_table"	2023-02-03 17:52:25 -08:00
sysfs
sysv	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
tracefs	fs: port ->mkdir() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
ubifs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
udf	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
ufs	fs: port inode_init_owner() to mnt_idmap	2023-01-19 09:24:28 +01:00
unicode
vboxsf	fs: port ->rename() to pass mnt_idmap	2023-01-19 09:24:26 +01:00
verity	fsverity: support verifying data from large folios	2023-01-27 14:46:31 -08:00
xfs	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
zonefs	zonefs changes for 6.3-rc1	2023-02-22 14:11:54 -08:00
aio.c	Merge branch 'mm-hotfixes-stable' into mm-stable	2023-02-10 15:34:48 -08:00
anon_inodes.c
attr.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
bad_inode.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
binfmt_elf_fdpic.c	elfcore: Add a cprm parameter to elf_core_extra_{phdrs,data_size}	2023-01-05 15:12:12 +00:00
binfmt_elf_test.c
binfmt_elf.c	Linux 6.2-rc6	2023-01-31 15:01:20 +01:00
binfmt_flat.c
binfmt_misc.c	binfmt_misc: fix shift-out-of-bounds in check_special_flags	2022-12-02 13:57:04 -08:00
binfmt_script.c
buffer.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
char_dev.c	chardev: fix error handling in cdev_device_add()	2022-12-02 17:48:59 +01:00
compat_binfmt_elf.c
coredump.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
d_path.c
dax.c	fsdax: dax_unshare_iter() should return a valid length	2023-02-03 17:52:24 -08:00
dcache.c	tmpfile API change	2022-10-10 19:45:17 -07:00
direct-io.c	fs: move sb_init_dio_done_wq out of direct-io.c	2023-01-26 10:30:56 -07:00
drop_caches.c
eventfd.c	eventfd: provide a eventfd_signal_mask() helper	2022-11-22 06:07:55 -07:00
eventpoll.c	eventpoll: add EPOLL_URING_WAKE poll wakeup flag	2022-11-21 07:45:29 -07:00
exec.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
fcntl.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
fhandle.c
file_table.c	filelock: move file locking definitions to separate header file	2023-01-11 06:52:32 -05:00
file.c	fs: use acquire ordering in __fget_light()	2022-10-31 15:30:11 -04:00
filesystems.c
fs_context.c
fs_parser.c	ext4: journal_path mount options should follow links	2022-12-01 10:46:54 -05:00
fs_pin.c
fs_struct.c
fs_types.c
fs-writeback.c	mm: convert mem_cgroup_css_from_page() to mem_cgroup_css_from_folio()	2023-02-02 22:33:19 -08:00
fsopen.c
init.c	fs: port ->permission() to pass mnt_idmap	2023-01-19 09:24:28 +01:00
inode.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
internal.h	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
ioctl.c	fs: port inode_owner_or_capable() to mnt_idmap	2023-01-19 09:24:29 +01:00
Kconfig	fs: build the legacy direct I/O code conditionally	2023-01-26 10:30:56 -07:00
Kconfig.binfmt	Xtensa updates for v6.1	2022-10-10 14:21:11 -07:00
kernel_read_file.c
libfs.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
locks.c	RCU pull request for v6.3	2023-02-21 10:45:51 -08:00
Makefile	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
mbcache.c	ext4: fix deadlock due to mbcache entry corruption	2022-12-08 21:49:25 -05:00
mnt_idmapping.c	fs: move mnt_idmap	2023-01-19 09:24:30 +01:00
mount.h
mpage.c	- Daniel Verkamp has contributed a memfd series ("mm/memfd: add	2023-02-23 17:09:35 -08:00
namei.c	NFSD 6.3 Release Notes	2023-02-22 14:21:40 -08:00
namespace.c	fs: move mnt_idmap	2023-01-19 09:24:30 +01:00
no-block.c
nsfs.c
open.c	fs.v6.3	2023-02-20 12:03:55 -08:00
pipe.c
pnode.c	pnode: terminate at peers of source	2022-12-21 14:45:25 +01:00
pnode.h
posix_acl.c	fs.acl.v6.3	2023-02-20 12:14:33 -08:00
proc_namespace.c
read_write.c	iov_iter work; most of that is about getting rid of	2022-12-12 18:29:54 -08:00
readdir.c
remap_range.c	fs: port i_{g,u}id_into_vfs{g,u}id() to mnt_idmap	2023-01-19 09:24:29 +01:00
select.c
seq_file.c	use less confusing names for iov_iter direction initializers	2022-11-25 13:01:55 -05:00
signalfd.c
splice.c	46 fs/cifs (smb3 client) changesets, 37 in fs/cifs and 9 for related helper functions and cleanup outside from Dave Howells and Willy	2023-02-22 17:12:44 -08:00
stack.c
stat.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
statfs.c
super.c	for-6.3/dio-2023-02-16	2023-02-20 14:10:36 -08:00
sync.c
sysctls.c
timerfd.c
userfaultfd.c	mm: replace vma->vm_flags direct modifications with modifier calls	2023-02-09 16:51:39 -08:00
utimes.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00
xattr.c	fs.idmapped.v6.3	2023-02-20 11:53:11 -08:00