NFSv4.2: Rework scratch handling for READ_PLUS (again)

commit 303a78052091c81e9003915c521fdca1c7e117af upstream.

I found that the read code might send multiple requests using the same
nfs_pgio_header, but nfs4_proc_read_setup() is only called once. This is
how we ended up occasionally double-freeing the scratch buffer, but also
means we set a NULL pointer but non-zero length to the xdr scratch
buffer. This results in an oops the first time decoding needs to copy
something to scratch, which frequently happens when decoding READ_PLUS
hole segments.

I fix this by moving scratch handling into the pageio read code. I
provide a function to allocate scratch space for decoding read replies,
and free the scratch buffer when the nfs_pgio_header is freed.

Fixes: fbd2a05f29a9 (NFSv4.2: Rework scratch handling for READ_PLUS)
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index ae7d4a8c728c2fa78f04457cc19224bdbe60d619..4b07a0508f9d80d2069a01a49c55be95c20604b3 100644 (file)
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h
@@ -484,6 +484,7 @@ struct nfs_pgio_completion_ops;
 extern void nfs_pageio_init_read(struct nfs_pageio_descriptor *pgio,
                        struct inode *inode, bool force_mds,
                        const struct nfs_pgio_completion_ops *compl_ops);
+extern bool nfs_read_alloc_scratch(struct nfs_pgio_header *hdr, size_t size);
 extern void nfs_read_prepare(struct rpc_task *task, void *calldata);
 extern void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio);
 

diff --git a/fs/nfs/nfs42.h b/fs/nfs/nfs42.h
index 0fe5aacbcfdf1a9171ecbf03349c54d461df48ff..b59876b01a1e3c15206b7d12528e3e42312d3a42 100644 (file)
--- a/fs/nfs/nfs42.h
+++ b/fs/nfs/nfs42.h
@@ -13,6 +13,7 @@
  * more? Need to consider not to pre-alloc too much for a compound.
  */
 #define PNFS_LAYOUTSTATS_MAXDEV (4)
+#define READ_PLUS_SCRATCH_SIZE (16)
 
 /* nfs4.2proc.c */
 #ifdef CONFIG_NFS_V4_2

diff --git a/fs/nfs/nfs42xdr.c b/fs/nfs/nfs42xdr.c
index 75765382cc0e6919aa13d3bf7ee6e777b801c323..20aa5e746497d08f640a0152f255f8c52b6fb54a 100644 (file)
--- a/fs/nfs/nfs42xdr.c
+++ b/fs/nfs/nfs42xdr.c
@@ -1351,7 +1351,7 @@ static int nfs4_xdr_dec_read_plus(struct rpc_rqst *rqstp,
        struct compound_hdr hdr;
        int status;
 
-       xdr_set_scratch_buffer(xdr, res->scratch, sizeof(res->scratch));
+       xdr_set_scratch_buffer(xdr, res->scratch, READ_PLUS_SCRATCH_SIZE);
 
        status = decode_compound_hdr(xdr, &hdr);
        if (status)

diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index b707a23c25e9d11c555541a43c4a06207b8c13c7..2dec0fed1ba1685ef133903a09d235eb584be985 100644 (file)
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5444,18 +5444,8 @@ static bool nfs4_read_plus_not_supported(struct rpc_task *task,
        return false;
 }
 
-static inline void nfs4_read_plus_scratch_free(struct nfs_pgio_header *hdr)
-{
-       if (hdr->res.scratch) {
-               kfree(hdr->res.scratch);
-               hdr->res.scratch = NULL;
-       }
-}
-
 static int nfs4_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
 {
-       nfs4_read_plus_scratch_free(hdr);
-
        if (!nfs4_sequence_done(task, &hdr->res.seq_res))
                return -EAGAIN;
        if (nfs4_read_stateid_changed(task, &hdr->args))
@@ -5475,8 +5465,7 @@ static bool nfs42_read_plus_support(struct nfs_pgio_header *hdr,
        /* Note: We don't use READ_PLUS with pNFS yet */
        if (nfs_server_capable(hdr->inode, NFS_CAP_READ_PLUS) && !hdr->ds_clp) {
                msg->rpc_proc = &nfs4_procedures[NFSPROC4_CLNT_READ_PLUS];
-               hdr->res.scratch = kmalloc(32, GFP_KERNEL);
-               return hdr->res.scratch != NULL;
+               return nfs_read_alloc_scratch(hdr, READ_PLUS_SCRATCH_SIZE);
        }
        return false;
 }

diff --git a/fs/nfs/read.c b/fs/nfs/read.c
index cd970ce62786ba0aed9d07391658738053491987..6aad42fbf797a1caf5b9ebd63f4c6cd132176097 100644 (file)
--- a/fs/nfs/read.c
+++ b/fs/nfs/read.c
@@ -47,6 +47,8 @@ static struct nfs_pgio_header *nfs_readhdr_alloc(void)
 
 static void nfs_readhdr_free(struct nfs_pgio_header *rhdr)
 {
+       if (rhdr->res.scratch != NULL)
+               kfree(rhdr->res.scratch);
        kmem_cache_free(nfs_rdata_cachep, rhdr);
 }
 
@@ -109,6 +111,14 @@ void nfs_pageio_reset_read_mds(struct nfs_pageio_descriptor *pgio)
 }
 EXPORT_SYMBOL_GPL(nfs_pageio_reset_read_mds);
 
+bool nfs_read_alloc_scratch(struct nfs_pgio_header *hdr, size_t size)
+{
+       WARN_ON(hdr->res.scratch != NULL);
+       hdr->res.scratch = kmalloc(size, GFP_KERNEL);
+       return hdr->res.scratch != NULL;
+}
+EXPORT_SYMBOL_GPL(nfs_read_alloc_scratch);
+
 static void nfs_readpage_release(struct nfs_page *req, int error)
 {
        struct inode *inode = d_inode(nfs_req_openctx(req)->dentry);