* Re: [PATCH] nfs4: Ensure that ACL pages sent over NFS were not allocated from the slab
[not found] ` <1299257053-13175-1-git-send-email-nhorman-2XuSBdqkA4R54TAoqtyWWQ@public.gmane.org>
@ 2011-03-04 16:58 ` Christoph Hellwig
0 siblings, 0 replies; only message in thread
From: Christoph Hellwig @ 2011-03-04 16:58 UTC (permalink / raw)
To: Neil Horman
Cc: linux-nfs-u79uwXL29TY76Z2rM5mHXA, Trond Myklebust,
security-DgEjT+Ai2ygdnm+yROfE0A, Jeff Layton,
linux-fsdevel-u79uwXL29TY76Z2rM5mHXA
> It occurs, because an skb with a fraglist was freed from the tcp retransmit
> queue when it was acked, but a page on that fraglist had PG_Slab set (indicating
> it was allocated from the Slab allocator (which means the free path above can't
> safely free it via put_page)
>
> We tracked this back to an nfsv4 setacl operation, in which the nfs code
> attempted to fill convert the passed in buffer to an array of pages in
> __nfs4_proc_set_acl, which gets used by the skb->frags list in xs_sendpages.
> __nfs4_proc_set_acl just converts each page in the buffer to a page struct via
> virt_to_page, but the vfs allocates the buffer via kmalloc, meaning the PG_slab
> bit is set. We can't create a buffer with kmalloc and free it later in the tcp
> ack path with put_page, so we need to either:
Note that the same thing can also happen with ext4 sending kmalloc'ed
buffers through network based block storage. Long time ago we had the
same issue with XFS and went to great length to avoid sending down
kmalloc'ed pages, but recently we (fs developers) were told that's just
fine. Consequently ext4 now actually uses slab pages for I/O, and we
are planning to make use of that fact soon again in XFS, too.
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
^ permalink raw reply [flat|nested] only message in thread