[PATCH v2 3/6] pNFS: don't leak layout segments when prepare_layoutcommit fails

[Benjamin Coddington <ben.coddington@hammerspace.com>]

From: Benjamin Coddington <bcodding@hammerspace.com>

pnfs_list_write_lseg() clears NFS_LSEG_LAYOUTCOMMIT on each segment that
needs a LAYOUTCOMMIT and moves the reference that flag held onto
data->lseg_list, to be put when the LAYOUTCOMMIT completes.  If
->prepare_layoutcommit() fails with anything but -ENOSPC, no LAYOUTCOMMIT
is sent and data is freed with the segments still on that list, so their
references are never put.  The segments and their layout header are then
never freed.

Before freeing data, give each segment's reference back to
NFS_LSEG_LAYOUTCOMMIT if the layout stateid is still valid and the flag
hasn't been set again, so that the next LAYOUTCOMMIT, which the error path
has already rescheduled, takes it.  That keeps a segment invalidated
meanwhile pinned until its LAYOUTCOMMIT is sent, as it would have been.
Otherwise put the reference with pnfs_list_write_lseg_done(): if the
layout stateid was invalidated, every other LAYOUTCOMMIT reference has
already been dropped, and if the flag was set again, it holds a reference
of its own.

Once the segments can be freed, the layout header can be too, so only
reschedule the LAYOUTCOMMIT if the layout stateid is still valid.
pnfs_mark_layout_stateid_invalid() clears NFS_INO_LAYOUTCOMMIT, and
setting it again would leave the next pnfs_layoutcommit_inode() to
dereference a NULL nfsi->layout.

Fixes: 5f919c9f10c1 ("pnfs: allow splicing pre-encoded pages into the layoutcommit args")
Signed-off-by: Benjamin Coddington <bcodding@hammerspace.com>
---
 fs/nfs/pnfs.c | 28 +++++++++++++++++++++++-----
 1 file changed, 23 insertions(+), 5 deletions(-)

diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c
index 6d391985fb21..393de479da3b 100644
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -3634,6 +3634,17 @@ static void pnfs_list_write_lseg(struct inode *inode, struct list_head *listp)
 	}
 }
 
+static void pnfs_list_write_lseg_undo(struct list_head *listp)
+{
+	struct pnfs_layout_segment *lseg, *tmp;
+
+	list_for_each_entry_safe(lseg, tmp, listp, pls_lc_list) {
+		if (pnfs_layout_is_valid(lseg->pls_layout) &&
+		    !test_and_set_bit(NFS_LSEG_LAYOUTCOMMIT, &lseg->pls_flags))
+			list_del_init(&lseg->pls_lc_list);
+	}
+}
+
 static void pnfs_list_write_lseg_done(struct inode *inode, struct list_head *listp)
 {
 	struct pnfs_layout_segment *lseg, *tmp;
@@ -3763,11 +3774,18 @@ pnfs_layoutcommit_inode(struct inode *inode, bool sync)
 			if (status != -ENOSPC)
 				put_cred(data->cred);
 			spin_lock(&inode->i_lock);
-			set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags);
-			if (end_pos > nfsi->layout->plh_lwb)
-				nfsi->layout->plh_lwb = end_pos;
-			if (status != -ENOSPC)
-				goto out_unlock;
+			if (pnfs_layout_is_valid(nfsi->layout)) {
+				set_bit(NFS_INO_LAYOUTCOMMIT, &nfsi->flags);
+				if (end_pos > nfsi->layout->plh_lwb)
+					nfsi->layout->plh_lwb = end_pos;
+			}
+			if (status != -ENOSPC) {
+				pnfs_list_write_lseg_undo(&data->lseg_list);
+				spin_unlock(&inode->i_lock);
+				pnfs_list_write_lseg_done(inode, &data->lseg_list);
+				kfree(data);
+				goto out;
+			}
 			spin_unlock(&inode->i_lock);
 			mark_as_dirty = true;
 		}
-- 
2.53.0