From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CB8141DA0E1; Mon, 23 Mar 2026 16:21:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774282895; cv=none; b=D4T6D/ZTrN/yHtIjJvRFGv3Ym4Hipl9nD0LWrJxN4Y6wtV4FPRX/f1X8vpWueN4pYMorT3ePe4jmtIBBBenmWFoZXytbx33GcFHcIaGVBcLl6uR818RSjPfJywokhxgMIgCYEuUvZWB3VfEobK9YU2L48FmYXwceO6Bjif/5HWI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1774282895; c=relaxed/simple; bh=KXZMKzZ5lbwNETOam0VigdyONNf/s3nl+PC2RoUHqUA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pMCtASR12y97/JELV32vwwfR3wCyWF1qr/kcSwoK+OkxaeR9kH7Gc/woyBIN8rX94TZ1Q2z44c0i5CENJ3g6t5cRpTn3SEmQSkh8NmKWD3GvXTHl7x18VYi7SpcPgW5Xeqh9q0NI9L3bDaIc8Q8Y29rMVSUbK1YpORehJKj4wjM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=1uPBsnq3; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="1uPBsnq3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D484C4CEF7; Mon, 23 Mar 2026 16:21:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1774282895; bh=KXZMKzZ5lbwNETOam0VigdyONNf/s3nl+PC2RoUHqUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1uPBsnq3jKABJ2l3KnFHsQgzHCXuYycByJNPaQAmb2hmTuZsPoiKKhjyLqdNJi7kE Zj2Cysg5yb7SIYv4eDJK9m8JZ3M5533eBhBE3uGmVGMI1puMlQhqLdxGomC3dWJWY/ hJCiMQYkA2xf4uRSJ6vT/j+kkftE69cB59ae7mLo= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, NeilBrown , stable@kernel.org, Jeff Layton , Chuck Lever Subject: [PATCH 6.1 282/481] sunrpc: fix cache_request leak in cache_release Date: Mon, 23 Mar 2026 14:44:24 +0100 Message-ID: <20260323134531.987913625@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260323134525.256603107@linuxfoundation.org> References: <20260323134525.256603107@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeff Layton commit 17ad31b3a43b72aec3a3d83605891e1397d0d065 upstream. When a reader's file descriptor is closed while in the middle of reading a cache_request (rp->offset != 0), cache_release() decrements the request's readers count but never checks whether it should free the request. In cache_read(), when readers drops to 0 and CACHE_PENDING is clear, the cache_request is removed from the queue and freed along with its buffer and cache_head reference. cache_release() lacks this cleanup. The only other path that frees requests with readers == 0 is cache_dequeue(), but it runs only when CACHE_PENDING transitions from set to clear. If that transition already happened while readers was still non-zero, cache_dequeue() will have skipped the request, and no subsequent call will clean it up. Add the same cleanup logic from cache_read() to cache_release(): after decrementing readers, check if it reached 0 with CACHE_PENDING clear, and if so, dequeue and free the cache_request. Reported-by: NeilBrown Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@kernel.org Signed-off-by: Jeff Layton Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman --- net/sunrpc/cache.c | 26 +++++++++++++++++++++----- 1 file changed, 21 insertions(+), 5 deletions(-) --- a/net/sunrpc/cache.c +++ b/net/sunrpc/cache.c @@ -1052,14 +1052,25 @@ static int cache_release(struct inode *i struct cache_reader *rp = filp->private_data; if (rp) { + struct cache_request *rq = NULL; + spin_lock(&queue_lock); if (rp->offset) { struct cache_queue *cq; - for (cq= &rp->q; &cq->list != &cd->queue; - cq = list_entry(cq->list.next, struct cache_queue, list)) + for (cq = &rp->q; &cq->list != &cd->queue; + cq = list_entry(cq->list.next, + struct cache_queue, list)) if (!cq->reader) { - container_of(cq, struct cache_request, q) - ->readers--; + struct cache_request *cr = + container_of(cq, + struct cache_request, q); + cr->readers--; + if (cr->readers == 0 && + !test_bit(CACHE_PENDING, + &cr->item->flags)) { + list_del(&cr->q.list); + rq = cr; + } break; } rp->offset = 0; @@ -1067,9 +1078,14 @@ static int cache_release(struct inode *i list_del(&rp->q.list); spin_unlock(&queue_lock); + if (rq) { + cache_put(rq->item, cd); + kfree(rq->buf); + kfree(rq); + } + filp->private_data = NULL; kfree(rp); - } if (filp->f_mode & FMODE_WRITE) { atomic_dec(&cd->writers);