sunrpc: fix cache_request leak in cache_release

When a reader's file descriptor is closed while in the middle of reading
a cache_request (rp->offset != 0), cache_release() decrements the
request's readers count but never checks whether it should free the
request.

In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the
cache_request is removed from the queue and freed along with its buffer
and cache_head reference. cache_release() lacks this cleanup.

The only other path that frees requests with readers == 0 is
cache_dequeue(), but it runs only when CACHE_PENDING transitions from
set to clear. If that transition already happened while readers was
still non-zero, cache_dequeue() will have skipped the request, and no
subsequent call will clean it up.

Add the same cleanup logic from cache_read() to cache_release(): after
decrementing readers, check if it reached 0 with CACHE_PENDING clear,
and if so, dequeue and free the cache_request.

Reported-by: NeilBrown <neilb@ownmail.net>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@kernel.org
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 131090f31e6a8322cf819e004cde151c1e5c0b64..6f6e0d4928afd6ff7d588147219a33dcf28aa5c8 100644 (file)
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -1061,14 +1061,25 @@ static int cache_release(struct inode *inode, struct file *filp,
        struct cache_reader *rp = filp->private_data;
 
        if (rp) {
+               struct cache_request *rq = NULL;
+
                spin_lock(&queue_lock);
                if (rp->offset) {
                        struct cache_queue *cq;
-                       for (cq= &rp->q; &cq->list != &cd->queue;
-                            cq = list_entry(cq->list.next, struct cache_queue, list))
+                       for (cq = &rp->q; &cq->list != &cd->queue;
+                            cq = list_entry(cq->list.next,
+                                            struct cache_queue, list))
                                if (!cq->reader) {
-                                       container_of(cq, struct cache_request, q)
-                                               ->readers--;
+                                       struct cache_request *cr =
+                                               container_of(cq,
+                                               struct cache_request, q);
+                                       cr->readers--;
+                                       if (cr->readers == 0 &&
+                                           !test_bit(CACHE_PENDING,
+                                                     &cr->item->flags)) {
+                                               list_del(&cr->q.list);
+                                               rq = cr;
+                                       }
                                        break;
                                }
                        rp->offset = 0;
@@ -1076,9 +1087,14 @@ static int cache_release(struct inode *inode, struct file *filp,
                list_del(&rp->q.list);
                spin_unlock(&queue_lock);
 
+               if (rq) {
+                       cache_put(rq->item, cd);
+                       kfree(rq->buf);
+                       kfree(rq);
+               }
+
                filp->private_data = NULL;
                kfree(rp);
-
        }
        if (filp->f_mode & FMODE_WRITE) {
                atomic_dec(&cd->writers);