diff options
| author | Christoph Hellwig <hch@lst.de> | 2019-06-17 11:14:12 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2019-06-17 09:33:04 -0600 |
| commit | 4569180495600ac59f5cd27f67242a6cb51254f3 (patch) | |
| tree | 5fc8de0946ff131ad03282d9bad310f29814a9b0 | |
| parent | ff896738be381efa6e50ba9a3b6cdc94f69ada42 (diff) | |
| download | linux-stable-4569180495600ac59f5cd27f67242a6cb51254f3.tar.gz linux-stable-4569180495600ac59f5cd27f67242a6cb51254f3.tar.bz2 linux-stable-4569180495600ac59f5cd27f67242a6cb51254f3.zip | |
block: fix page leak when merging to same page
When multiple iovecs reference the same page, each get_user_page call
will add a reference to the page. But once we've created the bio that
information gets lost and only a single reference will be dropped after
I/O completion. Use the same_page information returned from
__bio_try_merge_page to drop additional references to pages that were
already present in the bio.
Based on a patch from Ming Lei.
Link: https://lkml.org/lkml/2019/4/23/64
Fixes: 576ed913 ("block: use bio_add_page in bio_iov_iter_get_pages")
Reported-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | block/bio.c | 12 |
1 files changed, 10 insertions, 2 deletions
diff --git a/block/bio.c b/block/bio.c index daa1c1ae72cd..ce797d73bb43 100644 --- a/block/bio.c +++ b/block/bio.c @@ -896,6 +896,7 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) unsigned short entries_left = bio->bi_max_vecs - bio->bi_vcnt; struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt; struct page **pages = (struct page **)bv; + bool same_page = false; ssize_t size, left; unsigned len, i; size_t offset; @@ -916,8 +917,15 @@ static int __bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) struct page *page = pages[i]; len = min_t(size_t, PAGE_SIZE - offset, left); - if (WARN_ON_ONCE(bio_add_page(bio, page, len, offset) != len)) - return -EINVAL; + + if (__bio_try_merge_page(bio, page, len, offset, &same_page)) { + if (same_page) + put_page(page); + } else { + if (WARN_ON_ONCE(bio_full(bio))) + return -EINVAL; + __bio_add_page(bio, page, len, offset); + } offset = 0; } |