Commit d6fd6f82 authored by Max Kellermann's avatar Max Kellermann Committed by Ilya Dryomov
Browse files

ceph: fix memory leaks in __ceph_sync_read() 



In two `break` statements, the call to ceph_release_page_vector() was
missing, leaking the allocation from ceph_alloc_page_vector().

Instead of adding the missing ceph_release_page_vector() calls, the
Ceph maintainers preferred to transfer page ownership to the
`ceph_osd_request` by passing `own_pages=true` to
osd_req_op_extent_osd_data_pages().  This requires postponing the
ceph_osdc_put_request() call until after the block that accesses the
`pages`.

Cc: stable@vger.kernel.org
Fixes: 03bc06c7 ("ceph: add new mount option to enable sparse reads")
Fixes: f0fe1e54 ("ceph: plumb in decryption during reads")
Signed-off-by: default avatarMax Kellermann <max.kellermann@ionos.com>
Reviewed-by: default avatarIlya Dryomov <idryomov@gmail.com>
Signed-off-by: default avatarIlya Dryomov <idryomov@gmail.com>
parent 78d4f34e

fs/ceph/file.c

+3 −4
Original line number Diff line number Diff line
@@ -1127,7 +1127,7 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, 


		osd_req_op_extent_osd_data_pages(req, 0, pages, read_len,

						 offset_in_page(read_off),

						 false, false);

						 false, true);



		op = &req->r_ops[0];

		if (sparse) {
@@ -1186,8 +1186,6 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, 
			ret = min_t(ssize_t, fret, len);

		}



		ceph_osdc_put_request(req);



		/* Short read but not EOF? Zero out the remainder. */

		if (ret >= 0 && ret < len && (off + ret < i_size)) {

			int zlen = min(len - ret, i_size - off - ret);
@@ -1221,7 +1219,8 @@ ssize_t __ceph_sync_read(struct inode *inode, loff_t *ki_pos, 
				break;

			}

		}

		ceph_release_page_vector(pages, num_pages);



		ceph_osdc_put_request(req);



		if (ret < 0) {

			if (ret == -EBLOCKLISTED)