lkml.org 
[lkml]   [2014]   [Feb]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.5 61/88] fuse: fix pipe_buf_operations
    Date
    3.5.7.30 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Miklos Szeredi <mszeredi@suse.cz>

    commit 28a625cbc2a14f17b83e47ef907b2658576a32aa upstream.

    Having this struct in module memory could Oops when if the module is
    unloaded while the buffer still persists in a pipe.

    Since sock_pipe_buf_ops is essentially the same as fuse_dev_pipe_buf_steal
    merge them into nosteal_pipe_buf_ops (this is the same as
    default_pipe_buf_ops except stealing the page from the buffer is not
    allowed).

    Reported-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
    [ luis: backported to 3.5: adjusted context ]
    Signed-off-by: Luis Henriques <luis.henriques@canonical.com>
    ---
    fs/fuse/dev.c | 22 +++++-----------------
    fs/splice.c | 18 ++++++++++++++++++
    include/linux/pipe_fs_i.h | 2 ++
    net/core/skbuff.c | 32 +-------------------------------
    4 files changed, 26 insertions(+), 48 deletions(-)

    diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
    index f4246cf..fd074cd 100644
    --- a/fs/fuse/dev.c
    +++ b/fs/fuse/dev.c
    @@ -1199,22 +1199,6 @@ static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
    return fuse_dev_do_read(fc, file, &cs, iov_length(iov, nr_segs));
    }

    -static int fuse_dev_pipe_buf_steal(struct pipe_inode_info *pipe,
    - struct pipe_buffer *buf)
    -{
    - return 1;
    -}
    -
    -static const struct pipe_buf_operations fuse_dev_pipe_buf_ops = {
    - .can_merge = 0,
    - .map = generic_pipe_buf_map,
    - .unmap = generic_pipe_buf_unmap,
    - .confirm = generic_pipe_buf_confirm,
    - .release = generic_pipe_buf_release,
    - .steal = fuse_dev_pipe_buf_steal,
    - .get = generic_pipe_buf_get,
    -};
    -
    static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
    struct pipe_inode_info *pipe,
    size_t len, unsigned int flags)
    @@ -1261,7 +1245,11 @@ static ssize_t fuse_dev_splice_read(struct file *in, loff_t *ppos,
    buf->page = bufs[page_nr].page;
    buf->offset = bufs[page_nr].offset;
    buf->len = bufs[page_nr].len;
    - buf->ops = &fuse_dev_pipe_buf_ops;
    + /*
    + * Need to be careful about this. Having buf->ops in module
    + * code can Oops if the buffer persists after module unload.
    + */
    + buf->ops = &nosteal_pipe_buf_ops;

    pipe->nrbufs++;
    page_nr++;
    diff --git a/fs/splice.c b/fs/splice.c
    index 6cb3acb..74ff4f0 100644
    --- a/fs/splice.c
    +++ b/fs/splice.c
    @@ -553,6 +553,24 @@ static const struct pipe_buf_operations default_pipe_buf_ops = {
    .get = generic_pipe_buf_get,
    };

    +static int generic_pipe_buf_nosteal(struct pipe_inode_info *pipe,
    + struct pipe_buffer *buf)
    +{
    + return 1;
    +}
    +
    +/* Pipe buffer operations for a socket and similar. */
    +const struct pipe_buf_operations nosteal_pipe_buf_ops = {
    + .can_merge = 0,
    + .map = generic_pipe_buf_map,
    + .unmap = generic_pipe_buf_unmap,
    + .confirm = generic_pipe_buf_confirm,
    + .release = generic_pipe_buf_release,
    + .steal = generic_pipe_buf_nosteal,
    + .get = generic_pipe_buf_get,
    +};
    +EXPORT_SYMBOL(nosteal_pipe_buf_ops);
    +
    static ssize_t kernel_readv(struct file *file, const struct iovec *vec,
    unsigned long vlen, loff_t offset)
    {
    diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
    index e1ac1ce..e51bbd3 100644
    --- a/include/linux/pipe_fs_i.h
    +++ b/include/linux/pipe_fs_i.h
    @@ -158,6 +158,8 @@ int generic_pipe_buf_confirm(struct pipe_inode_info *, struct pipe_buffer *);
    int generic_pipe_buf_steal(struct pipe_inode_info *, struct pipe_buffer *);
    void generic_pipe_buf_release(struct pipe_inode_info *, struct pipe_buffer *);

    +extern const struct pipe_buf_operations nosteal_pipe_buf_ops;
    +
    /* for F_SETPIPE_SZ and F_GETPIPE_SZ */
    long pipe_fcntl(struct file *, unsigned int, unsigned long arg);
    struct pipe_inode_info *get_pipe_info(struct file *file);
    diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    index 7ed8ef3..1e37e1a 100644
    --- a/net/core/skbuff.c
    +++ b/net/core/skbuff.c
    @@ -74,36 +74,6 @@
    struct kmem_cache *skbuff_head_cache __read_mostly;
    static struct kmem_cache *skbuff_fclone_cache __read_mostly;

    -static void sock_pipe_buf_release(struct pipe_inode_info *pipe,
    - struct pipe_buffer *buf)
    -{
    - put_page(buf->page);
    -}
    -
    -static void sock_pipe_buf_get(struct pipe_inode_info *pipe,
    - struct pipe_buffer *buf)
    -{
    - get_page(buf->page);
    -}
    -
    -static int sock_pipe_buf_steal(struct pipe_inode_info *pipe,
    - struct pipe_buffer *buf)
    -{
    - return 1;
    -}
    -
    -
    -/* Pipe buffer operations for a socket. */
    -static const struct pipe_buf_operations sock_pipe_buf_ops = {
    - .can_merge = 0,
    - .map = generic_pipe_buf_map,
    - .unmap = generic_pipe_buf_unmap,
    - .confirm = generic_pipe_buf_confirm,
    - .release = sock_pipe_buf_release,
    - .steal = sock_pipe_buf_steal,
    - .get = sock_pipe_buf_get,
    -};
    -
    /*
    * Keep out-of-line to prevent kernel bloat.
    * __builtin_return_address is not used because it is not always
    @@ -1710,7 +1680,7 @@ int skb_splice_bits(struct sk_buff *skb, unsigned int offset,
    .partial = partial,
    .nr_pages_max = MAX_SKB_FRAGS,
    .flags = flags,
    - .ops = &sock_pipe_buf_ops,
    + .ops = &nosteal_pipe_buf_ops,
    .spd_release = sock_spd_release,
    };
    struct sk_buff *frag_iter;
    --
    1.8.3.2


    \
     
     \ /
      Last update: 2014-02-07 12:41    [W:4.063 / U:0.308 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site