1. 19 6月, 2019 1 次提交
  2. 15 6月, 2019 1 次提交
  3. 14 6月, 2019 1 次提交
  4. 13 6月, 2019 1 次提交
    • E
      io_uring: fix memory leak of UNIX domain socket inode · 355e8d26
      Eric Biggers 提交于
      Opening and closing an io_uring instance leaks a UNIX domain socket
      inode.  This is because the ->file of the io_uring instance's internal
      UNIX domain socket is set to point to the io_uring file, but then
      sock_release() sees the non-NULL ->file and assumes the inode reference
      is held by the file so doesn't call iput().  That's not the case here,
      since the reference is still meant to be held by the socket; the actual
      inode of the io_uring file is different.
      
      Fix this leak by NULL-ing out ->file before releasing the socket.
      
      Reported-by: syzbot+111cb28d9f583693aefa@syzkaller.appspotmail.com
      Fixes: 2b188cc1 ("Add io_uring IO interface")
      Cc: <stable@vger.kernel.org> # v5.1+
      Signed-off-by: NEric Biggers <ebiggers@google.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      355e8d26
  5. 07 6月, 2019 1 次提交
    • N
      btrfs: Always trim all unallocated space in btrfs_trim_free_extents · 8103d10b
      Nikolay Borisov 提交于
      This patch removes support for range parameters of FITRIM ioctl when
      trimming unallocated space on devices. This is necessary since ranges
      passed from user space are generally interpreted as logical addresses,
      whereas btrfs_trim_free_extents used to interpret them as device
      physical extents. This could result in counter-intuitive behavior for
      users so it's best to remove that support altogether.
      
      Additionally, the existing range support had a bug where if an offset
      was passed to FITRIM which overflows u64 e.g. -1 (parsed as u64
      18446744073709551615) then wrong data was fed into btrfs_issue_discard,
      which in turn leads to wrap-around when aligning the passed range and
      results in wrong regions being discarded which leads to data corruption.
      
      Fixes: c2d1b3aa ("btrfs: Honour FITRIM range constraints during free space trim")
      Reviewed-by: NQu Wenruo <wqu@suse.com>
      Signed-off-by: NNikolay Borisov <nborisov@suse.com>
      Signed-off-by: NDavid Sterba <dsterba@suse.com>
      8103d10b
  6. 06 6月, 2019 4 次提交
    • B
      Revert "gfs2: Replace gl_revokes with a GLF flag" · 638803d4
      Bob Peterson 提交于
      Commit 73118ca8 introduced a glock reference counting bug in
      gfs2_trans_remove_revoke.  Given that, replacing gl_revokes with a GLF flag is
      no longer useful, so revert that commit.
      Signed-off-by: NBob Peterson <rpeterso@redhat.com>
      Signed-off-by: NAndreas Gruenbacher <agruenba@redhat.com>
      638803d4
    • Y
      ceph: fix error handling in ceph_get_caps() · 7b2f936f
      Yan, Zheng 提交于
      The function return 0 even when interrupted or try_get_cap_refs()
      return error.
      
      Fixes: 1199d7da ("ceph: simplify arguments and return semantics of try_get_cap_refs")
      Signed-off-by: N"Yan, Zheng" <zyan@redhat.com>
      Reviewed-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NIlya Dryomov <idryomov@gmail.com>
      7b2f936f
    • Y
      ceph: avoid iput_final() while holding mutex or in dispatch thread · 3e1d0452
      Yan, Zheng 提交于
      iput_final() may wait for reahahead pages. The wait can cause deadlock.
      For example:
      
        Workqueue: ceph-msgr ceph_con_workfn [libceph]
          Call Trace:
           schedule+0x36/0x80
           io_schedule+0x16/0x40
           __lock_page+0x101/0x140
           truncate_inode_pages_range+0x556/0x9f0
           truncate_inode_pages_final+0x4d/0x60
           evict+0x182/0x1a0
           iput+0x1d2/0x220
           iterate_session_caps+0x82/0x230 [ceph]
           dispatch+0x678/0xa80 [ceph]
           ceph_con_workfn+0x95b/0x1560 [libceph]
           process_one_work+0x14d/0x410
           worker_thread+0x4b/0x460
           kthread+0x105/0x140
           ret_from_fork+0x22/0x40
      
        Workqueue: ceph-msgr ceph_con_workfn [libceph]
          Call Trace:
           __schedule+0x3d6/0x8b0
           schedule+0x36/0x80
           schedule_preempt_disabled+0xe/0x10
           mutex_lock+0x2f/0x40
           ceph_check_caps+0x505/0xa80 [ceph]
           ceph_put_wrbuffer_cap_refs+0x1e5/0x2c0 [ceph]
           writepages_finish+0x2d3/0x410 [ceph]
           __complete_request+0x26/0x60 [libceph]
           handle_reply+0x6c8/0xa10 [libceph]
           dispatch+0x29a/0xbb0 [libceph]
           ceph_con_workfn+0x95b/0x1560 [libceph]
           process_one_work+0x14d/0x410
           worker_thread+0x4b/0x460
           kthread+0x105/0x140
           ret_from_fork+0x22/0x40
      
      In above example, truncate_inode_pages_range() waits for readahead pages
      while holding s_mutex. ceph_check_caps() waits for s_mutex and blocks
      OSD dispatch thread. Later OSD replies (for readahead) can't be handled.
      
      ceph_check_caps() also may lock snap_rwsem for read. So similar deadlock
      can happen if iput_final() is called while holding snap_rwsem.
      
      In general, it's not good to call iput_final() inside MDS/OSD dispatch
      threads or while holding any mutex.
      
      The fix is introducing ceph_async_iput(), which calls iput_final() in
      workqueue.
      Signed-off-by: N"Yan, Zheng" <zyan@redhat.com>
      Reviewed-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NIlya Dryomov <idryomov@gmail.com>
      3e1d0452
    • Y
      ceph: single workqueue for inode related works · 1cf89a8d
      Yan, Zheng 提交于
      We have three workqueue for inode works. Later patch will introduce
      one more work for inode. It's not good to introcuce more workqueue
      and add more 'struct work_struct' to 'struct ceph_inode_info'.
      Signed-off-by: N"Yan, Zheng" <zyan@redhat.com>
      Reviewed-by: NJeff Layton <jlayton@redhat.com>
      Signed-off-by: NIlya Dryomov <idryomov@gmail.com>
      1cf89a8d
  7. 05 6月, 2019 10 次提交
  8. 04 6月, 2019 1 次提交
  9. 02 6月, 2019 1 次提交
  10. 31 5月, 2019 19 次提交