NFS: Directory page cache pages need to be locked when read

When a NFS directory page cache page is removed from the page cache,
its contents are freed through a call to nfs_readdir_clear_array().
To prevent the removal of the page cache entry until after we've
finished reading it, we must take the page lock.

Fixes: e2bf13823337 ("NFS: Fix a memory leak in nfs_readdir")
Cc: stable@vger.kernel.org # v2.6.37+
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>

diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index 451c48cdb1c2d7fda4ef89e682f6d5e84c1baa0c..d95c2c94bd8764229669af8082451468d84881e8 100644 (file)
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -702,8 +702,6 @@ int nfs_readdir_filler(void *data, struct page* page)
 static
 void cache_page_release(nfs_readdir_descriptor_t *desc)
 {
-       if (!desc->page->mapping)
-               nfs_readdir_clear_array(desc->page);
        put_page(desc->page);
        desc->page = NULL;
 }
@@ -717,19 +715,28 @@ struct page *get_cache_page(nfs_readdir_descriptor_t *desc)
 
 /*
  * Returns 0 if desc->dir_cookie was found on page desc->page_index
+ * and locks the page to prevent removal from the page cache.
  */
 static
-int find_cache_page(nfs_readdir_descriptor_t *desc)
+int find_and_lock_cache_page(nfs_readdir_descriptor_t *desc)
 {
        int res;
 
        desc->page = get_cache_page(desc);
        if (IS_ERR(desc->page))
                return PTR_ERR(desc->page);
-
-       res = nfs_readdir_search_array(desc);
+       res = lock_page_killable(desc->page);
        if (res != 0)
-               cache_page_release(desc);
+               goto error;
+       res = -EAGAIN;
+       if (desc->page->mapping != NULL) {
+               res = nfs_readdir_search_array(desc);
+               if (res == 0)
+                       return 0;
+       }
+       unlock_page(desc->page);
+error:
+       cache_page_release(desc);
        return res;
 }
 
@@ -744,7 +751,7 @@ int readdir_search_pagecache(nfs_readdir_descriptor_t *desc)
                desc->last_cookie = 0;
        }
        do {
-               res = find_cache_page(desc);
+               res = find_and_lock_cache_page(desc);
        } while (res == -EAGAIN);
        return res;
 }
@@ -783,7 +790,6 @@ int nfs_do_filldir(nfs_readdir_descriptor_t *desc)
                desc->eof = true;
 
        kunmap(desc->page);
-       cache_page_release(desc);
        dfprintk(DIRCACHE, "NFS: nfs_do_filldir() filling ended @ cookie %Lu; returning = %d\n",
                        (unsigned long long)*desc->dir_cookie, res);
        return res;
@@ -829,13 +835,13 @@ int uncached_readdir(nfs_readdir_descriptor_t *desc)
 
        status = nfs_do_filldir(desc);
 
+ out_release:
+       nfs_readdir_clear_array(desc->page);
+       cache_page_release(desc);
  out:
        dfprintk(DIRCACHE, "NFS: %s: returns %d\n",
                        __func__, status);
        return status;
- out_release:
-       cache_page_release(desc);
-       goto out;
 }
 
 /* The file offset position represents the dirent entry number.  A
@@ -900,6 +906,8 @@ static int nfs_readdir(struct file *file, struct dir_context *ctx)
                        break;
 
                res = nfs_do_filldir(desc);
+               unlock_page(desc->page);
+               cache_page_release(desc);
                if (res < 0)
                        break;
        } while (!desc->eof);