From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Subject: Re: [PATCH] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab Date: Fri, 4 Mar 2011 11:58:52 -0500 Message-ID: <20110304165852.GA2679@infradead.org> References: <1299257053-13175-1-git-send-email-nhorman@tuxdriver.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Trond Myklebust , security-DgEjT+Ai2ygdnm+yROfE0A@public.gmane.org, Jeff Layton , linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Neil Horman Return-path: Content-Disposition: inline In-Reply-To: <1299257053-13175-1-git-send-email-nhorman-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org> Sender: linux-nfs-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-Id: linux-fsdevel.vger.kernel.org > It occurs, because an skb with a fraglist was freed from the tcp retransmit > queue when it was acked, but a page on that fraglist had PG_Slab set (indicating > it was allocated from the Slab allocator (which means the free path above can't > safely free it via put_page) > > We tracked this back to an nfsv4 setacl operation, in which the nfs code > attempted to fill convert the passed in buffer to an array of pages in > __nfs4_proc_set_acl, which gets used by the skb->frags list in xs_sendpages. > __nfs4_proc_set_acl just converts each page in the buffer to a page struct via > virt_to_page, but the vfs allocates the buffer via kmalloc, meaning the PG_slab > bit is set. We can't create a buffer with kmalloc and free it later in the tcp > ack path with put_page, so we need to either: Note that the same thing can also happen with ext4 sending kmalloc'ed buffers through network based block storage. Long time ago we had the same issue with XFS and went to great length to avoid sending down kmalloc'ed pages, but recently we (fs developers) were told that's just fine. Consequently ext4 now actually uses slab pages for I/O, and we are planning to make use of that fact soon again in XFS, too. -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html