cifs: fix page reference leak with readv/writev

CIFS can leak pages reference gotten through GUP (get_user_pages*()
through iov_iter_get_pages()). This happen if cifs_send_async_read()
or cifs_write_from_iter() calls fail from within __cifs_readv() and
__cifs_writev() respectively. This patch move page unreference to
cifs_aio_ctx_release() which will happens on all code paths this is
all simpler to follow for correctness.

Signed-off-by: Jérôme Glisse <jglisse@redhat.com>
Cc: Steve French <sfrench@samba.org>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Reviewed-by: Pavel Shilovsky <pshilov@microsoft.com>

1 files changed, 22 insertions, 1 deletions

diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index 1e1626a2cfc3..0dc6f08020ac 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -789,6 +789,11 @@ cifs_aio_ctx_alloc(void)
 {
         struct cifs_aio_ctx *ctx;
 
+        /*
+         * Must use kzalloc to initialize ctx->bv to NULL and ctx->direct_io
+         * to false so that we know when we have to unreference pages within
+         * cifs_aio_ctx_release()
+         */
         ctx = kzalloc(sizeof(struct cifs_aio_ctx), GFP_KERNEL);
         if (!ctx)
                 return NULL;
@@ -807,7 +812,23 @@ cifs_aio_ctx_release(struct kref *refcount)
                                         struct cifs_aio_ctx, refcount);
 
         cifsFileInfo_put(ctx->cfile);
-        kvfree(ctx->bv);
+
+        /*
+         * ctx->bv is only set if setup_aio_ctx_iter() was call successfuly
+         * which means that iov_iter_get_pages() was a success and thus that
+         * we have taken reference on pages.
+         */
+        if (ctx->bv) {
+                unsigned i;
+
+                for (i = 0; i < ctx->npages; i++) {
+                        if (ctx->should_dirty)
+                                set_page_dirty(ctx->bv[i].bv_page);
+                        put_page(ctx->bv[i].bv_page);
+                }
+                kvfree(ctx->bv);
+        }
+
         kfree(ctx);
 }