Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1203511

[PATCH 3.10 02/26] freeing unlinked file indefinitely delayed

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.10 02/26] freeing unlinked file indefinitely delayed
Date 2015-08-09 00:50 +0200
Message-ID <pVl6a-45c-3@gated-at.bofh.it> (permalink)
References <pVkts-3jX-13@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.10-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Al Viro <viro@ZenIV.linux.org.uk>

commit 75a6f82a0d10ef8f13cd8fe7212911a0252ab99e upstream.

	Normally opening a file, unlinking it and then closing will have
the inode freed upon close() (provided that it's not otherwise busy and
has no remaining links, of course).  However, there's one case where that
does *not* happen.  Namely, if you open it by fhandle with cold dcache,
then unlink() and close().

	In normal case you get d_delete() in unlink(2) notice that dentry
is busy and unhash it; on the final dput() it will be forcibly evicted from
dcache, triggering iput() and inode removal.  In this case, though, we end
up with *two* dentries - disconnected (created by open-by-fhandle) and
regular one (used by unlink()).  The latter will have its reference to inode
dropped just fine, but the former will not - it's considered hashed (it
is on the ->s_anon list), so it will stay around until the memory pressure
will finally do it in.  As the result, we have the final iput() delayed
indefinitely.  It's trivial to reproduce -

void flush_dcache(void)
{
        system("mount -o remount,rw /");
}

static char buf[20 * 1024 * 1024];

main()
{
        int fd;
        union {
                struct file_handle f;
                char buf[MAX_HANDLE_SZ];
        } x;
        int m;

        x.f.handle_bytes = sizeof(x);
        chdir("/root");
        mkdir("foo", 0700);
        fd = open("foo/bar", O_CREAT | O_RDWR, 0600);
        close(fd);
        name_to_handle_at(AT_FDCWD, "foo/bar", &x.f, &m, 0);
        flush_dcache();
        fd = open_by_handle_at(AT_FDCWD, &x.f, O_RDWR);
        unlink("foo/bar");
        write(fd, buf, sizeof(buf));
        system("df .");			/* 20Mb eaten */
        close(fd);
        system("df .");			/* should've freed those 20Mb */
        flush_dcache();
        system("df .");			/* should be the same as #2 */
}

will spit out something like
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 303843      1131 100% /
Filesystem     1K-blocks   Used Available Use% Mounted on
/dev/root         322023 283282     21692  93% /
- inode gets freed only when dentry is finally evicted (here we trigger
than by remount; normally it would've happened in response to memory
pressure hell knows when).

Acked-by: J. Bruce Fields <bfields@fieldses.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 fs/dcache.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -520,6 +520,9 @@ repeat:
 		return;
 	}
 
+	if (unlikely(dentry->d_flags & DCACHE_DISCONNECTED))
+		goto kill_it;
+
 	if (dentry->d_flags & DCACHE_OP_DELETE) {
 		if (dentry->d_op->d_delete(dentry))
 			goto kill_it;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:10 +0200
  [PATCH 3.10 01/26] mm: avoid setting up anonymous pages into file mapping Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:10 +0200
  [PATCH 3.10 20/26] xhci: report U3 when link is in resume state Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:10 +0200
  [PATCH 3.10 22/26] rds: rds_ib_device.refcount overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:10 +0200
  [PATCH 3.10 12/26] mmc: sdhci-pxav3: fix platform_data is not initialized Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:10 +0200
  [PATCH 3.10 02/26] freeing unlinked file indefinitely delayed Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 10/26] mac80211: clear subdir_stations when removing debugfs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 14/26] tile: use free_bootmem_late() for initrd Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 21/26] xhci: prevent bus_suspend if SS port resuming in phase 1 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 04/26] ARC: make sure instruction_pointer() returns unsigned value Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 25/26] iscsi-target: Fix iser explicit logout TX kthread leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 24/26] iscsi-target: Fix use-after-free during TPG session shutdown Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 11/26] mmc: sdhci-esdhc: Make 8BIT bus work Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 07/26] ALSA: usb-audio: add dB range mapping for some devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 26/26] efi: fix 32bit kernel boot failed problem using efi Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 03/26] s390/sclp: clear upper register halves in _sclp_print_early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 13/26] md/raid1: fix test for was read error from last working device. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 08/26] ALSA: hda - Fix MacBook Pro 5,2 quirk Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 00:50 +0200
  [PATCH 3.10 18/26] usb-storage: ignore ZTE MF 823 card reader in mode 0x1225 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 01:00 +0200
  [PATCH 3.10 19/26] xhci: Calculate old endpoints correctly on device reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 01:00 +0200
  [PATCH 3.10 15/26] Input: usbtouchscreen - avoid unresponsive TSC-30 touch screen Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 01:00 +0200
  [PATCH 3.10 17/26] ata: pmp: add quirk for Marvell 4140 SATA PMP Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 01:00 +0200
  [PATCH 3.10 16/26] blkcg: fix gendisk reference leak in blkg_conf_prep() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-09 01:00 +0200
  Re: [PATCH 3.10 00/26] 3.10.86-stable review Guenter Roeck <linux@roeck-us.net> - 2015-08-09 05:20 +0200
    Re: [PATCH 3.10 00/26] 3.10.86-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-10 21:20 +0200
  Re: [PATCH 3.10 00/26] 3.10.86-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2015-08-10 06:40 +0200
  Re: [PATCH 3.10 00/26] 3.10.86-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-08-10 20:20 +0200

csiph-web