NFS: Fix a page leak in nfs_destroy_unlinked_subrequests()

Trond Myklebust · gregkh · commit 194a805daefa · 2020-04-17T10:48:51.000+02:00
commit add42de upstream. When we detach a subrequest from the list, we must also release the reference it holds to the parent. Fixes: 5b2b518 ("NFS: Fix nfs_page_group_destroy() and nfs_lock_and_join_requests() race cases") Cc: stable@vger.kernel.org # v4.14+ Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/fs/nfs/write.c b/fs/nfs/write.c
@@ -432,6 +432,7 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,
 		}
 
 		subreq->wb_head = subreq;
+		nfs_release_request(old_head);
 
 		if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {
 			nfs_release_request(subreq);

Original file line number	Diff line number	Diff line change
`@@ -432,6 +432,7 @@ nfs_destroy_unlinked_subrequests(struct nfs_page *destroy_list,`
`432`	`432`	`}`
`433`	`433`
`434`	`434`	`subreq->wb_head = subreq;`
	`435`	`+ nfs_release_request(old_head);`
`435`	`436`
`436`	`437`	`if (test_and_clear_bit(PG_INODE_REF, &subreq->wb_flags)) {`
`437`	`438`	`nfs_release_request(subreq);`