[PATCH AUTOSEL 4.19 098/237] ceph: fix dentry leak in ceph_readdir_prepopulate

[PATCH AUTOSEL 4.19 098/237] ceph: fix dentry leak in ceph_readdir_prepopulate

[Sasha Levin]

From: "Yan, Zheng" <zyan@redhat.com>

[ Upstream commit c58f450bd61511d897efc2ea472c69630635b557 ]

Signed-off-by: "Yan, Zheng" <zyan@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/inode.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
index acb70a6a82f0f..1e438e0faf77e 100644
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -1694,7 +1694,6 @@ int ceph_readdir_prepopulate(struct ceph_mds_request *req,
 			if (IS_ERR(realdn)) {
 				err = PTR_ERR(realdn);
 				d_drop(dn);
-				dn = NULL;
 				goto next_item;
 			}
 			dn = realdn;
-- 
2.20.1

[PATCH AUTOSEL 4.19 099/237] ceph: only allow punch hole mode in fallocate

[Sasha Levin]

From: Luis Henriques <lhenriques@suse.com>

[ Upstream commit bddff633ab7bc60a18a86ac8b322695b6f8594d0 ]

Current implementation of cephfs fallocate isn't correct as it doesn't
really reserve the space in the cluster, which means that a subsequent
call to a write may actually fail due to lack of space.  In fact, it is
currently possible to fallocate an amount space that is larger than the
free space in the cluster.  It has behaved this way since the initial
commit ad7a60de882a ("ceph: punch hole support").

Since there's no easy solution to fix this at the moment, this patch
simply removes support for all fallocate operations but
FALLOC_FL_PUNCH_HOLE (which implies FALLOC_FL_KEEP_SIZE).

Link: https://tracker.ceph.com/issues/36317
Signed-off-by: Luis Henriques <lhenriques@suse.com>
Reviewed-by: "Yan, Zheng" <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/file.c | 45 +++++++++------------------------------------
 1 file changed, 9 insertions(+), 36 deletions(-)

diff --git a/fs/ceph/file.c b/fs/ceph/file.c
index 92ab204336829..91a7ad259bcf2 100644
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -1735,7 +1735,6 @@ static long ceph_fallocate(struct file *file, int mode,
 	struct ceph_file_info *fi = file->private_data;
 	struct inode *inode = file_inode(file);
 	struct ceph_inode_info *ci = ceph_inode(inode);
-	struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
 	struct ceph_cap_flush *prealloc_cf;
 	int want, got = 0;
 	int dirty;
@@ -1743,10 +1742,7 @@ static long ceph_fallocate(struct file *file, int mode,
 	loff_t endoff = 0;
 	loff_t size;
 
-	if ((offset + length) > max(i_size_read(inode), fsc->max_file_size))
-		return -EFBIG;
-
-	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
+	if (mode != (FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
 		return -EOPNOTSUPP;
 
 	if (!S_ISREG(inode->i_mode))
@@ -1763,18 +1759,6 @@ static long ceph_fallocate(struct file *file, int mode,
 		goto unlock;
 	}
 
-	if (!(mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE)) &&
-	    ceph_quota_is_max_bytes_exceeded(inode, offset + length)) {
-		ret = -EDQUOT;
-		goto unlock;
-	}
-
-	if (ceph_osdmap_flag(&fsc->client->osdc, CEPH_OSDMAP_FULL) &&
-	    !(mode & FALLOC_FL_PUNCH_HOLE)) {
-		ret = -ENOSPC;
-		goto unlock;
-	}
-
 	if (ci->i_inline_version != CEPH_INLINE_NONE) {
 		ret = ceph_uninline_data(file, NULL);
 		if (ret < 0)
@@ -1782,12 +1766,12 @@ static long ceph_fallocate(struct file *file, int mode,
 	}
 
 	size = i_size_read(inode);
-	if (!(mode & FALLOC_FL_KEEP_SIZE)) {
-		endoff = offset + length;
-		ret = inode_newsize_ok(inode, endoff);
-		if (ret)
-			goto unlock;
-	}
+
+	/* Are we punching a hole beyond EOF? */
+	if (offset >= size)
+		goto unlock;
+	if ((offset + length) > size)
+		length = size - offset;
 
 	if (fi->fmode & CEPH_FILE_MODE_LAZY)
 		want = CEPH_CAP_FILE_BUFFER | CEPH_CAP_FILE_LAZYIO;
@@ -1798,16 +1782,8 @@ static long ceph_fallocate(struct file *file, int mode,
 	if (ret < 0)
 		goto unlock;
 
-	if (mode & FALLOC_FL_PUNCH_HOLE) {
-		if (offset < size)
-			ceph_zero_pagecache_range(inode, offset, length);
-		ret = ceph_zero_objects(inode, offset, length);
-	} else if (endoff > size) {
-		truncate_pagecache_range(inode, size, -1);
-		if (ceph_inode_set_size(inode, endoff))
-			ceph_check_caps(ceph_inode(inode),
-				CHECK_CAPS_AUTHONLY, NULL);
-	}
+	ceph_zero_pagecache_range(inode, offset, length);
+	ret = ceph_zero_objects(inode, offset, length);
 
 	if (!ret) {
 		spin_lock(&ci->i_ceph_lock);
@@ -1817,9 +1793,6 @@ static long ceph_fallocate(struct file *file, int mode,
 		spin_unlock(&ci->i_ceph_lock);
 		if (dirty)
 			__mark_inode_dirty(inode, dirty);
-		if ((endoff > size) &&
-		    ceph_quota_is_max_bytes_approaching(inode, endoff))
-			ceph_check_caps(ci, CHECK_CAPS_NODELAY, NULL);
 	}
 
 	ceph_put_cap_refs(ci, got);
-- 
2.20.1

[PATCH AUTOSEL 4.19 100/237] libceph: don't consume a ref on pagelist in ceph_msg_data_add_pagelist()

[Sasha Levin]

From: Ilya Dryomov <idryomov@gmail.com>

[ Upstream commit 894868330a1e038ea4a65dbb81741eef70ad71b1 ]

Because send_mds_reconnect() wants to send a message with a pagelist
and pass the ownership to the messenger, ceph_msg_data_add_pagelist()
consumes a ref which is then put in ceph_msg_data_destroy().  This
makes managing pagelists in the OSD client (where they are wrapped in
ceph_osd_data) unnecessarily hard because the handoff only happens in
ceph_osdc_start_request() instead of when the pagelist is passed to
ceph_osd_data_pagelist_init().  I counted several memory leaks on
various error paths.

Fix up ceph_msg_data_add_pagelist() and carry a pagelist ref in
ceph_osd_data.

Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 fs/ceph/mds_client.c  | 2 +-
 net/ceph/messenger.c  | 1 +
 net/ceph/osd_client.c | 8 ++++++++
 3 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 09db6d08614d2..94494d05a94cb 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -2184,7 +2184,6 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
 
 	if (req->r_pagelist) {
 		struct ceph_pagelist *pagelist = req->r_pagelist;
-		refcount_inc(&pagelist->refcnt);
 		ceph_msg_data_add_pagelist(msg, pagelist);
 		msg->hdr.data_len = cpu_to_le32(pagelist->length);
 	} else {
@@ -3289,6 +3288,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
 	mutex_unlock(&mdsc->mutex);
 
 	up_read(&mdsc->snap_rwsem);
+	ceph_pagelist_release(pagelist);
 	return;
 
 fail:
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index f7d7f32ac673c..2c8cd339d59ea 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -3323,6 +3323,7 @@ void ceph_msg_data_add_pagelist(struct ceph_msg *msg,
 
 	data = ceph_msg_data_create(CEPH_MSG_DATA_PAGELIST);
 	BUG_ON(!data);
+	refcount_inc(&pagelist->refcnt);
 	data->pagelist = pagelist;
 
 	list_add_tail(&data->links, &msg->data);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 76c41a84550e7..c3494c1fb3a9a 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -126,6 +126,9 @@ static void ceph_osd_data_init(struct ceph_osd_data *osd_data)
 	osd_data->type = CEPH_OSD_DATA_TYPE_NONE;
 }
 
+/*
+ * Consumes @pages if @own_pages is true.
+ */
 static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
 			struct page **pages, u64 length, u32 alignment,
 			bool pages_from_pool, bool own_pages)
@@ -138,6 +141,9 @@ static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
 	osd_data->own_pages = own_pages;
 }
 
+/*
+ * Consumes a ref on @pagelist.
+ */
 static void ceph_osd_data_pagelist_init(struct ceph_osd_data *osd_data,
 			struct ceph_pagelist *pagelist)
 {
@@ -362,6 +368,8 @@ static void ceph_osd_data_release(struct ceph_osd_data *osd_data)
 		num_pages = calc_pages_for((u64)osd_data->alignment,
 						(u64)osd_data->length);
 		ceph_release_page_vector(osd_data->pages, num_pages);
+	} else if (osd_data->type == CEPH_OSD_DATA_TYPE_PAGELIST) {
+		ceph_pagelist_release(osd_data->pagelist);
 	}
 	ceph_osd_data_init(osd_data);
 }
-- 
2.20.1

Re: [PATCH AUTOSEL 4.19 100/237] libceph: don't consume a ref on pagelist in ceph_msg_data_add_pagelist()

[Ilya Dryomov]

On Sat, Nov 16, 2019 at 4:43 PM Sasha Levin <sashal@kernel.org> wrote:
>
> From: Ilya Dryomov <idryomov@gmail.com>
>
> [ Upstream commit 894868330a1e038ea4a65dbb81741eef70ad71b1 ]
>
> Because send_mds_reconnect() wants to send a message with a pagelist
> and pass the ownership to the messenger, ceph_msg_data_add_pagelist()
> consumes a ref which is then put in ceph_msg_data_destroy().  This
> makes managing pagelists in the OSD client (where they are wrapped in
> ceph_osd_data) unnecessarily hard because the handoff only happens in
> ceph_osdc_start_request() instead of when the pagelist is passed to
> ceph_osd_data_pagelist_init().  I counted several memory leaks on
> various error paths.
>
> Fix up ceph_msg_data_add_pagelist() and carry a pagelist ref in
> ceph_osd_data.
>
> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
>  fs/ceph/mds_client.c  | 2 +-
>  net/ceph/messenger.c  | 1 +
>  net/ceph/osd_client.c | 8 ++++++++
>  3 files changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
> index 09db6d08614d2..94494d05a94cb 100644
> --- a/fs/ceph/mds_client.c
> +++ b/fs/ceph/mds_client.c
> @@ -2184,7 +2184,6 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
>
>         if (req->r_pagelist) {
>                 struct ceph_pagelist *pagelist = req->r_pagelist;
> -               refcount_inc(&pagelist->refcnt);
>                 ceph_msg_data_add_pagelist(msg, pagelist);
>                 msg->hdr.data_len = cpu_to_le32(pagelist->length);
>         } else {
> @@ -3289,6 +3288,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
>         mutex_unlock(&mdsc->mutex);
>
>         up_read(&mdsc->snap_rwsem);
> +       ceph_pagelist_release(pagelist);
>         return;
>
>  fail:
> diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
> index f7d7f32ac673c..2c8cd339d59ea 100644
> --- a/net/ceph/messenger.c
> +++ b/net/ceph/messenger.c
> @@ -3323,6 +3323,7 @@ void ceph_msg_data_add_pagelist(struct ceph_msg *msg,
>
>         data = ceph_msg_data_create(CEPH_MSG_DATA_PAGELIST);
>         BUG_ON(!data);
> +       refcount_inc(&pagelist->refcnt);
>         data->pagelist = pagelist;
>
>         list_add_tail(&data->links, &msg->data);
> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
> index 76c41a84550e7..c3494c1fb3a9a 100644
> --- a/net/ceph/osd_client.c
> +++ b/net/ceph/osd_client.c
> @@ -126,6 +126,9 @@ static void ceph_osd_data_init(struct ceph_osd_data *osd_data)
>         osd_data->type = CEPH_OSD_DATA_TYPE_NONE;
>  }
>
> +/*
> + * Consumes @pages if @own_pages is true.
> + */
>  static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
>                         struct page **pages, u64 length, u32 alignment,
>                         bool pages_from_pool, bool own_pages)
> @@ -138,6 +141,9 @@ static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
>         osd_data->own_pages = own_pages;
>  }
>
> +/*
> + * Consumes a ref on @pagelist.
> + */
>  static void ceph_osd_data_pagelist_init(struct ceph_osd_data *osd_data,
>                         struct ceph_pagelist *pagelist)
>  {
> @@ -362,6 +368,8 @@ static void ceph_osd_data_release(struct ceph_osd_data *osd_data)
>                 num_pages = calc_pages_for((u64)osd_data->alignment,
>                                                 (u64)osd_data->length);
>                 ceph_release_page_vector(osd_data->pages, num_pages);
> +       } else if (osd_data->type == CEPH_OSD_DATA_TYPE_PAGELIST) {
> +               ceph_pagelist_release(osd_data->pagelist);
>         }
>         ceph_osd_data_init(osd_data);
>  }

Hi Sasha,

This commit was part of a larger series and shouldn't be backported on
its own.  Please drop it.

Thanks,

                Ilya

Re: [PATCH AUTOSEL 4.19 100/237] libceph: don't consume a ref on pagelist in ceph_msg_data_add_pagelist()

[Sasha Levin]

On Sat, Nov 16, 2019 at 05:23:28PM +0100, Ilya Dryomov wrote:
>On Sat, Nov 16, 2019 at 4:43 PM Sasha Levin <sashal@kernel.org> wrote:
>>
>> From: Ilya Dryomov <idryomov@gmail.com>
>>
>> [ Upstream commit 894868330a1e038ea4a65dbb81741eef70ad71b1 ]
>>
>> Because send_mds_reconnect() wants to send a message with a pagelist
>> and pass the ownership to the messenger, ceph_msg_data_add_pagelist()
>> consumes a ref which is then put in ceph_msg_data_destroy().  This
>> makes managing pagelists in the OSD client (where they are wrapped in
>> ceph_osd_data) unnecessarily hard because the handoff only happens in
>> ceph_osdc_start_request() instead of when the pagelist is passed to
>> ceph_osd_data_pagelist_init().  I counted several memory leaks on
>> various error paths.
>>
>> Fix up ceph_msg_data_add_pagelist() and carry a pagelist ref in
>> ceph_osd_data.
>>
>> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
>> Signed-off-by: Sasha Levin <sashal@kernel.org>
>> ---
>>  fs/ceph/mds_client.c  | 2 +-
>>  net/ceph/messenger.c  | 1 +
>>  net/ceph/osd_client.c | 8 ++++++++
>>  3 files changed, 10 insertions(+), 1 deletion(-)
>>
>> diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
>> index 09db6d08614d2..94494d05a94cb 100644
>> --- a/fs/ceph/mds_client.c
>> +++ b/fs/ceph/mds_client.c
>> @@ -2184,7 +2184,6 @@ static struct ceph_msg *create_request_message(struct ceph_mds_client *mdsc,
>>
>>         if (req->r_pagelist) {
>>                 struct ceph_pagelist *pagelist = req->r_pagelist;
>> -               refcount_inc(&pagelist->refcnt);
>>                 ceph_msg_data_add_pagelist(msg, pagelist);
>>                 msg->hdr.data_len = cpu_to_le32(pagelist->length);
>>         } else {
>> @@ -3289,6 +3288,7 @@ static void send_mds_reconnect(struct ceph_mds_client *mdsc,
>>         mutex_unlock(&mdsc->mutex);
>>
>>         up_read(&mdsc->snap_rwsem);
>> +       ceph_pagelist_release(pagelist);
>>         return;
>>
>>  fail:
>> diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
>> index f7d7f32ac673c..2c8cd339d59ea 100644
>> --- a/net/ceph/messenger.c
>> +++ b/net/ceph/messenger.c
>> @@ -3323,6 +3323,7 @@ void ceph_msg_data_add_pagelist(struct ceph_msg *msg,
>>
>>         data = ceph_msg_data_create(CEPH_MSG_DATA_PAGELIST);
>>         BUG_ON(!data);
>> +       refcount_inc(&pagelist->refcnt);
>>         data->pagelist = pagelist;
>>
>>         list_add_tail(&data->links, &msg->data);
>> diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
>> index 76c41a84550e7..c3494c1fb3a9a 100644
>> --- a/net/ceph/osd_client.c
>> +++ b/net/ceph/osd_client.c
>> @@ -126,6 +126,9 @@ static void ceph_osd_data_init(struct ceph_osd_data *osd_data)
>>         osd_data->type = CEPH_OSD_DATA_TYPE_NONE;
>>  }
>>
>> +/*
>> + * Consumes @pages if @own_pages is true.
>> + */
>>  static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
>>                         struct page **pages, u64 length, u32 alignment,
>>                         bool pages_from_pool, bool own_pages)
>> @@ -138,6 +141,9 @@ static void ceph_osd_data_pages_init(struct ceph_osd_data *osd_data,
>>         osd_data->own_pages = own_pages;
>>  }
>>
>> +/*
>> + * Consumes a ref on @pagelist.
>> + */
>>  static void ceph_osd_data_pagelist_init(struct ceph_osd_data *osd_data,
>>                         struct ceph_pagelist *pagelist)
>>  {
>> @@ -362,6 +368,8 @@ static void ceph_osd_data_release(struct ceph_osd_data *osd_data)
>>                 num_pages = calc_pages_for((u64)osd_data->alignment,
>>                                                 (u64)osd_data->length);
>>                 ceph_release_page_vector(osd_data->pages, num_pages);
>> +       } else if (osd_data->type == CEPH_OSD_DATA_TYPE_PAGELIST) {
>> +               ceph_pagelist_release(osd_data->pagelist);
>>         }
>>         ceph_osd_data_init(osd_data);
>>  }
>
>Hi Sasha,
>
>This commit was part of a larger series and shouldn't be backported on
>its own.  Please drop it.

Dropped, thanks!

-- 
Thanks,
Sasha