linux-kernel - Re: [PATCH 1/2] block: fix leaks associated with discard request payload

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20100627174721D.fujita.tomonori@lab.ntt.co.jp>
Date:	Sun, 27 Jun 2010 17:49:29 +0900
From:	FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
To:	snitzer@...hat.com
Cc:	hch@....de, axboe@...nel.dk, dm-devel@...hat.com,
	James.Bottomley@...e.de, linux-kernel@...r.kernel.org,
	martin.petersen@...cle.com, akpm@...ux-foundation.org
Subject: Re: [PATCH 1/2] block: fix leaks associated with discard request
 payload

On Sat, 26 Jun 2010 15:56:50 -0400
Mike Snitzer <snitzer@...hat.com> wrote:

> Fix leaks introduced via "block: don't allocate a payload for discard
> request" commit a1d949f5f44.
> 
> sd_done() is not called for REQ_TYPE_BLOCK_PC commands so cleanup
> discard request's payload directly in scsi_finish_command().

Instead of adding another discard hack to scsi_finish_command(), how
about converting discard to REQ_TYPE_FS request? discard is FS request
from the perspective of the block layer. It also fixes a problem that
discard isn't retried in the case of UNIT ATTENTION.

I think that we can get more cleaner code if we handle discard as
normal (fs) request in the block layer (and scsi-ml). We need more
changes but this patch is the first step.

This patch depends on the patchset to convert flush request to
REQ_TYPE_FS:

http://marc.info/?l=linux-kernel&m=127730591527424&w=2

The git tree is also available:

git://git.kernel.org/pub/scm/linux/kernel/git/tomo/linux-2.6-misc.git flush


> Also cleanup page allocated for discard payload in
> scsi_setup_discard_cmnd's scsi_setup_blk_pc_cmnd error path.

This patch doesn't address on this (since it's a different problem). I
think that scsi_setup_discard_cmnd() sees if it already allocates a
page before allocating a page. That's similar to how other prep
functions work, I think.

=
From: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
Subject: [PATCH] convert discard request to REQ_TYPE_FS instead of BLOCK_PC

Signed-off-by: FUJITA Tomonori <fujita.tomonori@....ntt.co.jp>
---
 block/blk-lib.c   |    4 ++++
 drivers/scsi/sd.c |   11 +----------
 2 files changed, 5 insertions(+), 10 deletions(-)

diff --git a/block/blk-lib.c b/block/blk-lib.c
index e16185b..9e15c46 100644
--- a/block/blk-lib.c
+++ b/block/blk-lib.c
@@ -20,6 +20,10 @@ static void blkdev_discard_end_io(struct bio *bio, int err)
 	if (bio->bi_private)
 		complete(bio->bi_private);
 
+	/* free the page that the lower layer allocated */
+	if (bio_page(bio))
+		__free_page(bio_page(bio));
+
 	bio_put(bio);
 }
 
diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index d447726..1b182de 100644
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -432,7 +432,7 @@ static int scsi_setup_discard_cmnd(struct scsi_device *sdp, struct request *rq)
 		nr_sectors >>= 3;
 	}
 
-	rq->cmd_type = REQ_TYPE_BLOCK_PC;
+	rq->cmd_type = REQ_TYPE_FS;
 	rq->timeout = SD_TIMEOUT;
 
 	memset(rq->cmd, 0, rq->cmd_len);
@@ -1177,15 +1177,6 @@ static int sd_done(struct scsi_cmnd *SCpnt)
 	int sense_valid = 0;
 	int sense_deferred = 0;
 
-	/*
-	 * If this is a discard request that originated from the kernel
-	 * we need to free our payload here.  Note that we need to check
-	 * the request flag as the normal payload rules apply for
-	 * pass-through UNMAP / WRITE SAME requests.
-	 */
-	if (SCpnt->request->cmd_flags & REQ_DISCARD)
-		__free_page(bio_page(SCpnt->request->bio));
-
 	if (result) {
 		sense_valid = scsi_command_normalize_sense(SCpnt, &sshdr);
 		if (sense_valid)
-- 
1.6.5

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/