rbd: fix image request leak on parent read

[~andy/linux] / drivers / block / rbd.c

diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index e90abde47de04d27143a7473727a6da33b39aa13..c2ca1818f33583679ac3d96f8bbaa4f33949640a 100644 (file)
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -345,7 +345,11 @@ static DEFINE_SPINLOCK(rbd_dev_list_lock);
 static LIST_HEAD(rbd_client_list);             /* clients */
 static DEFINE_SPINLOCK(rbd_client_list_lock);
 
+/* Slab caches for frequently-allocated structures */
+
 static struct kmem_cache       *rbd_img_request_cache;
+static struct kmem_cache       *rbd_obj_request_cache;
+static struct kmem_cache       *rbd_segment_name_cache;
 
 static int rbd_img_request_submit(struct rbd_img_request *img_request);
 
@@ -984,7 +988,7 @@ static const char *rbd_segment_name(struct rbd_device *rbd_dev, u64 offset)
        u64 segment;
        int ret;
 
-       name = kmalloc(MAX_OBJ_NAME_SIZE + 1, GFP_NOIO);
+       name = kmem_cache_alloc(rbd_segment_name_cache, GFP_NOIO);
        if (!name)
                return NULL;
        segment = offset >> rbd_dev->header.obj_order;
@@ -1000,6 +1004,13 @@ static const char *rbd_segment_name(struct rbd_device *rbd_dev, u64 offset)
        return name;
 }
 
+static void rbd_segment_name_free(const char *name)
+{
+       /* The explicit cast here is needed to drop the const qualifier */
+
+       kmem_cache_free(rbd_segment_name_cache, (void *)name);
+}
+
 static u64 rbd_segment_offset(struct rbd_device *rbd_dev, u64 offset)
 {
        u64 segment_size = (u64) 1 << rbd_dev->header.obj_order;
@@ -1758,11 +1769,16 @@ static struct rbd_obj_request *rbd_obj_request_create(const char *object_name,
        rbd_assert(obj_request_type_valid(type));
 
        size = strlen(object_name) + 1;
-       obj_request = kzalloc(sizeof (*obj_request) + size, GFP_KERNEL);
-       if (!obj_request)
+       name = kmalloc(size, GFP_KERNEL);
+       if (!name)
+               return NULL;
+
+       obj_request = kmem_cache_zalloc(rbd_obj_request_cache, GFP_KERNEL);
+       if (!obj_request) {
+               kfree(name);
                return NULL;
+       }
 
-       name = (char *)(obj_request + 1);
        obj_request->object_name = memcpy(name, object_name, size);
        obj_request->offset = offset;
        obj_request->length = length;
@@ -1808,7 +1824,9 @@ static void rbd_obj_request_destroy(struct kref *kref)
                break;
        }
 
-       kfree(obj_request);
+       kfree(obj_request->object_name);
+       obj_request->object_name = NULL;
+       kmem_cache_free(rbd_obj_request_cache, obj_request);
 }
 
 /*
@@ -2025,7 +2043,8 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
                length = rbd_segment_length(rbd_dev, img_offset, resid);
                obj_request = rbd_obj_request_create(object_name,
                                                offset, length, type);
-               kfree(object_name);     /* object request has its own copy */
+               /* object request has its own copy of the object name */
+               rbd_segment_name_free(object_name);
                if (!obj_request)
                        goto out_unwind;
 
@@ -2528,6 +2547,7 @@ static void rbd_img_parent_read_callback(struct rbd_img_request *img_request)
                obj_request->xferred = img_request->xferred;
        }
 out:
+       rbd_img_request_put(img_request);
        rbd_img_obj_request_read_callback(obj_request);
        rbd_obj_request_complete(obj_request);
 }
@@ -5002,14 +5022,44 @@ static int rbd_slab_init(void)
                                        sizeof (struct rbd_img_request),
                                        __alignof__(struct rbd_img_request),
                                        0, NULL);
-       if (rbd_img_request_cache)
+       if (!rbd_img_request_cache)
+               return -ENOMEM;
+
+       rbd_assert(!rbd_obj_request_cache);
+       rbd_obj_request_cache = kmem_cache_create("rbd_obj_request",
+                                       sizeof (struct rbd_obj_request),
+                                       __alignof__(struct rbd_obj_request),
+                                       0, NULL);
+       if (!rbd_obj_request_cache)
+               goto out_err;
+
+       rbd_assert(!rbd_segment_name_cache);
+       rbd_segment_name_cache = kmem_cache_create("rbd_segment_name",
+                                       MAX_OBJ_NAME_SIZE + 1, 1, 0, NULL);
+       if (rbd_segment_name_cache)
                return 0;
+out_err:
+       if (rbd_obj_request_cache) {
+               kmem_cache_destroy(rbd_obj_request_cache);
+               rbd_obj_request_cache = NULL;
+       }
+
+       kmem_cache_destroy(rbd_img_request_cache);
+       rbd_img_request_cache = NULL;
 
        return -ENOMEM;
 }
 
 static void rbd_slab_exit(void)
 {
+       rbd_assert(rbd_segment_name_cache);
+       kmem_cache_destroy(rbd_segment_name_cache);
+       rbd_segment_name_cache = NULL;
+
+       rbd_assert(rbd_obj_request_cache);
+       kmem_cache_destroy(rbd_obj_request_cache);
+       rbd_obj_request_cache = NULL;
+
        rbd_assert(rbd_img_request_cache);
        kmem_cache_destroy(rbd_img_request_cache);
        rbd_img_request_cache = NULL;