Commit e3fe48f9 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 

Pull smb client fixes from Steve French:

 - Fix potential memory leak in mount

 - Add some missing read tracepoints

 - Fix locking issue with directory leases

* tag 'v6.18-rc6-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: Add the smb3_read_* tracepoints to SMB1
  cifs: fix memory leak in smb3_fs_context_parse_param error path
  smb: client: introduce close_cached_dir_locked()
parents a07a003c d5227c88

fs/smb/client/cached_dir.c

+38 −3
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ static struct cached_fid *init_cached_dir(const char *path); 
static void free_cached_dir(struct cached_fid *cfid);

static void smb2_close_cached_fid(struct kref *ref);

static void cfids_laundromat_worker(struct work_struct *work);

static void close_cached_dir_locked(struct cached_fid *cfid);



struct cached_dir_dentry {

	struct list_head entry;
@@ -388,7 +389,7 @@ int open_cached_dir(unsigned int xid, struct cifs_tcon *tcon, 
			 * lease. Release one here, and the second below.

			 */

			cfid->has_lease = false;

			close_cached_dir(cfid);

			close_cached_dir_locked(cfid);

		}

		spin_unlock(&cfids->cfid_list_lock);
@@ -480,18 +481,52 @@ void drop_cached_dir_by_name(const unsigned int xid, struct cifs_tcon *tcon, 
	spin_lock(&cfid->cfids->cfid_list_lock);

	if (cfid->has_lease) {

		cfid->has_lease = false;

		close_cached_dir(cfid);

		close_cached_dir_locked(cfid);

	}

	spin_unlock(&cfid->cfids->cfid_list_lock);

	close_cached_dir(cfid);

}





/**

 * close_cached_dir - drop a reference of a cached dir

 *

 * The release function will be called with cfid_list_lock held to remove the

 * cached dirs from the list before any other thread can take another @cfid

 * ref. Must not be called with cfid_list_lock held; use

 * close_cached_dir_locked() called instead.

 *

 * @cfid: cached dir

 */

void close_cached_dir(struct cached_fid *cfid)

{

	lockdep_assert_not_held(&cfid->cfids->cfid_list_lock);

	kref_put_lock(&cfid->refcount, smb2_close_cached_fid, &cfid->cfids->cfid_list_lock);

}



/**

 * close_cached_dir_locked - put a reference of a cached dir with

 * cfid_list_lock held

 *

 * Calling close_cached_dir() with cfid_list_lock held has the potential effect

 * of causing a deadlock if the invariant of refcount >= 2 is false.

 *

 * This function is used in paths that hold cfid_list_lock and expect at least

 * two references. If that invariant is violated, WARNs and returns without

 * dropping a reference; the final put must still go through

 * close_cached_dir().

 *

 * @cfid: cached dir

 */

static void close_cached_dir_locked(struct cached_fid *cfid)

{

	lockdep_assert_held(&cfid->cfids->cfid_list_lock);



	if (WARN_ON(kref_read(&cfid->refcount) < 2))

		return;



	kref_put(&cfid->refcount, smb2_close_cached_fid);

}



/*

 * Called from cifs_kill_sb when we unmount a share

 */

fs/smb/client/cifssmb.c

+22 −0
Original line number Diff line number Diff line
@@ -1363,6 +1363,14 @@ cifs_readv_callback(struct mid_q_entry *mid) 
	if (rdata->result == -ENODATA) {

		rdata->result = 0;

		__set_bit(NETFS_SREQ_HIT_EOF, &rdata->subreq.flags);

		trace_smb3_read_err(rdata->rreq->debug_id,

				    rdata->subreq.debug_index,

				    rdata->xid,

				    rdata->req->cfile->fid.persistent_fid,

				    tcon->tid, tcon->ses->Suid,

				    rdata->subreq.start + rdata->subreq.transferred,

				    rdata->subreq.len   - rdata->subreq.transferred,

				    rdata->result);

	} else {

		size_t trans = rdata->subreq.transferred + rdata->got_bytes;

		if (trans < rdata->subreq.len &&
@@ -1374,6 +1382,13 @@ cifs_readv_callback(struct mid_q_entry *mid) 
		}

		if (rdata->got_bytes)

			__set_bit(NETFS_SREQ_MADE_PROGRESS, &rdata->subreq.flags);

		trace_smb3_read_done(rdata->rreq->debug_id,

				     rdata->subreq.debug_index,

				     rdata->xid,

				     rdata->req->cfile->fid.persistent_fid,

				     tcon->tid, tcon->ses->Suid,

				     rdata->subreq.start + rdata->subreq.transferred,

				     rdata->got_bytes);

	}



	trace_smb3_rw_credits(rreq_debug_id, subreq_debug_index, rdata->credits.value,
@@ -1445,6 +1460,13 @@ cifs_async_readv(struct cifs_io_subrequest *rdata) 
	rdata->iov[1].iov_base = (char *)smb + 4;

	rdata->iov[1].iov_len = get_rfc1002_length(smb);



	trace_smb3_read_enter(rdata->rreq->debug_id,

			      rdata->subreq.debug_index,

			      rdata->xid,

			      rdata->req->cfile->fid.netfid,

			      tcon->tid, tcon->ses->Suid,

			      rdata->subreq.start, rdata->subreq.len);



	rc = cifs_call_async(tcon->ses->server, &rqst, cifs_readv_receive,

			     cifs_readv_callback, NULL, rdata, 0, NULL);

fs/smb/client/fs_context.c

+4 −0
Original line number Diff line number Diff line
@@ -1834,6 +1834,10 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, 
	ctx->password = NULL;

	kfree_sensitive(ctx->password2);

	ctx->password2 = NULL;

	kfree(ctx->source);

	ctx->source = NULL;

	kfree(fc->source);

	fc->source = NULL;

	return -EINVAL;

}