linux-kernel - [PATCH] f2fs: fix to avoid page count leak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Fri, 10 Apr 2020 16:51:23 +0800
From:   Chao Yu <yuchao0@...wei.com>
To:     <jaegeuk@...nel.org>
CC:     <linux-f2fs-devel@...ts.sourceforge.net>,
        <linux-kernel@...r.kernel.org>, <chao@...nel.org>,
        Chao Yu <yuchao0@...wei.com>
Subject: [PATCH] f2fs: fix to avoid page count leak

In below error path, we missed to release reference count of pages
in compressed cluster, fix it.
- f2fs_mpage_readpages()
 - f2fs_read_multi_pages()

Signed-off-by: Chao Yu <yuchao0@...wei.com>
---
 fs/f2fs/compress.c | 2 +-
 fs/f2fs/data.c     | 6 +++++-
 fs/f2fs/f2fs.h     | 1 +
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c
index 25d72e18ac30..d83dfbe624b0 100644
--- a/fs/f2fs/compress.c
+++ b/fs/f2fs/compress.c
@@ -88,7 +88,7 @@ static void f2fs_drop_rpages(struct compress_ctx *cc, int len, bool unlock)
 	}
 }
 
-static void f2fs_put_rpages(struct compress_ctx *cc)
+void f2fs_put_rpages(struct compress_ctx *cc)
 {
 	f2fs_drop_rpages(cc, cc->cluster_size, false);
 }
diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
index 0a829a89f596..896887c9febe 100644
--- a/fs/f2fs/data.c
+++ b/fs/f2fs/data.c
@@ -2115,7 +2115,7 @@ int f2fs_read_multi_pages(struct compress_ctx *cc, struct bio **bio_ret,
 		} else if (!PageUptodate(page)) {
 			continue;
 		}
-		unlock_page(page);
+		f2fs_put_page(page, 1);
 		cc->rpages[i] = NULL;
 		cc->nr_rpages--;
 	}
@@ -2280,6 +2280,8 @@ int f2fs_mpage_readpages(struct address_space *mapping,
 							max_nr_pages,
 							&last_block_in_bio,
 							is_readahead, false);
+				if (ret)
+					f2fs_put_rpages(&cc);
 				f2fs_destroy_compress_ctx(&cc);
 				if (ret)
 					goto set_error_page;
@@ -2323,6 +2325,8 @@ int f2fs_mpage_readpages(struct address_space *mapping,
 							max_nr_pages,
 							&last_block_in_bio,
 							is_readahead, false);
+				if (ret)
+					f2fs_put_rpages(&cc);
 				f2fs_destroy_compress_ctx(&cc);
 			}
 		}
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index ed354af78966..25cc202adc50 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -3790,6 +3790,7 @@ static inline bool f2fs_post_read_required(struct inode *inode)
  */
 #ifdef CONFIG_F2FS_FS_COMPRESSION
 bool f2fs_is_compressed_page(struct page *page);
+void f2fs_put_rpages(struct compress_ctx *cc);
 struct page *f2fs_compress_control_page(struct page *page);
 int f2fs_prepare_compress_overwrite(struct inode *inode,
 			struct page **pagep, pgoff_t index, void **fsdata);
-- 
2.18.0.rc1