NFS: Prevent integer overflow in nfs_scan_list()
[linux-2.6-block.git] / fs / nfs / pagelist.c
CommitLineData
1da177e4
LT
1/*
2 * linux/fs/nfs/pagelist.c
3 *
4 * A set of helper functions for managing NFS read and write requests.
5 * The main purpose of these routines is to provide support for the
6 * coalescing of several requests into a single RPC call.
7 *
8 * Copyright 2000, 2001 (c) Trond Myklebust <trond.myklebust@fys.uio.no>
9 *
10 */
11
1da177e4
LT
12#include <linux/slab.h>
13#include <linux/file.h>
e8edc6e0 14#include <linux/sched.h>
1da177e4
LT
15#include <linux/sunrpc/clnt.h>
16#include <linux/nfs3.h>
17#include <linux/nfs4.h>
18#include <linux/nfs_page.h>
19#include <linux/nfs_fs.h>
20#include <linux/nfs_mount.h>
21
8d5658c9
TM
22#include "internal.h"
23
e18b890b 24static struct kmem_cache *nfs_page_cachep;
1da177e4
LT
25
26static inline struct nfs_page *
27nfs_page_alloc(void)
28{
29 struct nfs_page *p;
e94b1766 30 p = kmem_cache_alloc(nfs_page_cachep, GFP_KERNEL);
1da177e4
LT
31 if (p) {
32 memset(p, 0, sizeof(*p));
33 INIT_LIST_HEAD(&p->wb_list);
34 }
35 return p;
36}
37
38static inline void
39nfs_page_free(struct nfs_page *p)
40{
41 kmem_cache_free(nfs_page_cachep, p);
42}
43
44/**
45 * nfs_create_request - Create an NFS read/write request.
46 * @file: file descriptor to use
47 * @inode: inode to which the request is attached
48 * @page: page to write
49 * @offset: starting offset within the page for the write
50 * @count: number of bytes to read/write
51 *
52 * The page must be locked by the caller. This makes sure we never
a19b89ca 53 * create two different requests for the same page.
1da177e4
LT
54 * User should ensure it is safe to sleep in this function.
55 */
56struct nfs_page *
57nfs_create_request(struct nfs_open_context *ctx, struct inode *inode,
58 struct page *page,
59 unsigned int offset, unsigned int count)
60{
61 struct nfs_server *server = NFS_SERVER(inode);
62 struct nfs_page *req;
63
1da177e4
LT
64 for (;;) {
65 /* try to allocate the request struct */
66 req = nfs_page_alloc();
67 if (req != NULL)
68 break;
69
1da177e4
LT
70 if (signalled() && (server->flags & NFS_MOUNT_INTR))
71 return ERR_PTR(-ERESTARTSYS);
72 yield();
73 }
74
75 /* Initialize the request struct. Initially, we assume a
76 * long write-back delay. This will be adjusted in
77 * update_nfs_request below if the region is not locked. */
78 req->wb_page = page;
79 atomic_set(&req->wb_complete, 0);
80 req->wb_index = page->index;
81 page_cache_get(page);
cd52ed35
TM
82 BUG_ON(PagePrivate(page));
83 BUG_ON(!PageLocked(page));
84 BUG_ON(page->mapping->host != inode);
1da177e4
LT
85 req->wb_offset = offset;
86 req->wb_pgbase = offset;
87 req->wb_bytes = count;
1da177e4 88 req->wb_context = get_nfs_open_context(ctx);
c03b4024 89 kref_init(&req->wb_kref);
1da177e4
LT
90 return req;
91}
92
93/**
94 * nfs_unlock_request - Unlock request and wake up sleepers.
95 * @req:
96 */
97void nfs_unlock_request(struct nfs_page *req)
98{
99 if (!NFS_WBACK_BUSY(req)) {
100 printk(KERN_ERR "NFS: Invalid unlock attempted\n");
101 BUG();
102 }
103 smp_mb__before_clear_bit();
104 clear_bit(PG_BUSY, &req->wb_flags);
105 smp_mb__after_clear_bit();
464a98bd 106 wake_up_bit(&req->wb_flags, PG_BUSY);
1da177e4
LT
107 nfs_release_request(req);
108}
109
c6a556b8 110/**
9fd367f0 111 * nfs_set_page_tag_locked - Tag a request as locked
c6a556b8
TM
112 * @req:
113 */
9fd367f0 114static int nfs_set_page_tag_locked(struct nfs_page *req)
c6a556b8 115{
88be9f99 116 struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
c6a556b8
TM
117
118 if (!nfs_lock_request(req))
119 return 0;
9fd367f0 120 radix_tree_tag_set(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
c6a556b8
TM
121 return 1;
122}
123
124/**
9fd367f0 125 * nfs_clear_page_tag_locked - Clear request tag and wake up sleepers
c6a556b8 126 */
9fd367f0 127void nfs_clear_page_tag_locked(struct nfs_page *req)
c6a556b8 128{
88be9f99 129 struct nfs_inode *nfsi = NFS_I(req->wb_context->path.dentry->d_inode);
c6a556b8 130
deb7d638
TM
131 if (req->wb_page != NULL) {
132 spin_lock(&nfsi->req_lock);
9fd367f0 133 radix_tree_tag_clear(&nfsi->nfs_page_tree, req->wb_index, NFS_PAGE_TAG_LOCKED);
deb7d638
TM
134 spin_unlock(&nfsi->req_lock);
135 }
c6a556b8
TM
136 nfs_unlock_request(req);
137}
138
1da177e4
LT
139/**
140 * nfs_clear_request - Free up all resources allocated to the request
141 * @req:
142 *
143 * Release page resources associated with a write request after it
144 * has completed.
145 */
146void nfs_clear_request(struct nfs_page *req)
147{
cd52ed35
TM
148 struct page *page = req->wb_page;
149 if (page != NULL) {
cd52ed35 150 page_cache_release(page);
1da177e4
LT
151 req->wb_page = NULL;
152 }
153}
154
155
156/**
157 * nfs_release_request - Release the count on an NFS read/write request
158 * @req: request to release
159 *
160 * Note: Should never be called with the spinlock held!
161 */
c03b4024 162static void nfs_free_request(struct kref *kref)
1da177e4 163{
c03b4024 164 struct nfs_page *req = container_of(kref, struct nfs_page, wb_kref);
1da177e4 165
1da177e4
LT
166 /* Release struct file or cached credential */
167 nfs_clear_request(req);
168 put_nfs_open_context(req->wb_context);
169 nfs_page_free(req);
170}
171
c03b4024
TM
172void nfs_release_request(struct nfs_page *req)
173{
174 kref_put(&req->wb_kref, nfs_free_request);
175}
176
464a98bd
TM
177static int nfs_wait_bit_interruptible(void *word)
178{
179 int ret = 0;
180
181 if (signal_pending(current))
182 ret = -ERESTARTSYS;
183 else
184 schedule();
185 return ret;
186}
187
1da177e4
LT
188/**
189 * nfs_wait_on_request - Wait for a request to complete.
190 * @req: request to wait upon.
191 *
192 * Interruptible by signals only if mounted with intr flag.
193 * The user is responsible for holding a count on the request.
194 */
195int
196nfs_wait_on_request(struct nfs_page *req)
197{
88be9f99 198 struct rpc_clnt *clnt = NFS_CLIENT(req->wb_context->path.dentry->d_inode);
464a98bd
TM
199 sigset_t oldmask;
200 int ret = 0;
201
202 if (!test_bit(PG_BUSY, &req->wb_flags))
203 goto out;
204 /*
205 * Note: the call to rpc_clnt_sigmask() suffices to ensure that we
206 * are not interrupted if intr flag is not set
207 */
208 rpc_clnt_sigmask(clnt, &oldmask);
209 ret = out_of_line_wait_on_bit(&req->wb_flags, PG_BUSY,
210 nfs_wait_bit_interruptible, TASK_INTERRUPTIBLE);
211 rpc_clnt_sigunmask(clnt, &oldmask);
212out:
213 return ret;
1da177e4
LT
214}
215
216/**
d8a5ad75
TM
217 * nfs_pageio_init - initialise a page io descriptor
218 * @desc: pointer to descriptor
bcb71bba
TM
219 * @inode: pointer to inode
220 * @doio: pointer to io function
221 * @bsize: io block size
222 * @io_flags: extra parameters for the io function
d8a5ad75 223 */
bcb71bba
TM
224void nfs_pageio_init(struct nfs_pageio_descriptor *desc,
225 struct inode *inode,
8d5658c9 226 int (*doio)(struct inode *, struct list_head *, unsigned int, size_t, int),
84dde76c 227 size_t bsize,
bcb71bba 228 int io_flags)
d8a5ad75
TM
229{
230 INIT_LIST_HEAD(&desc->pg_list);
bcb71bba 231 desc->pg_bytes_written = 0;
d8a5ad75
TM
232 desc->pg_count = 0;
233 desc->pg_bsize = bsize;
234 desc->pg_base = 0;
bcb71bba
TM
235 desc->pg_inode = inode;
236 desc->pg_doio = doio;
237 desc->pg_ioflags = io_flags;
238 desc->pg_error = 0;
d8a5ad75
TM
239}
240
241/**
242 * nfs_can_coalesce_requests - test two requests for compatibility
243 * @prev: pointer to nfs_page
244 * @req: pointer to nfs_page
245 *
246 * The nfs_page structures 'prev' and 'req' are compared to ensure that the
247 * page data area they describe is contiguous, and that their RPC
248 * credentials, NFSv4 open state, and lockowners are the same.
249 *
250 * Return 'true' if this is the case, else return 'false'.
251 */
252static int nfs_can_coalesce_requests(struct nfs_page *prev,
253 struct nfs_page *req)
254{
255 if (req->wb_context->cred != prev->wb_context->cred)
256 return 0;
257 if (req->wb_context->lockowner != prev->wb_context->lockowner)
258 return 0;
259 if (req->wb_context->state != prev->wb_context->state)
260 return 0;
261 if (req->wb_index != (prev->wb_index + 1))
262 return 0;
263 if (req->wb_pgbase != 0)
264 return 0;
265 if (prev->wb_pgbase + prev->wb_bytes != PAGE_CACHE_SIZE)
266 return 0;
267 return 1;
268}
269
270/**
bcb71bba 271 * nfs_pageio_do_add_request - Attempt to coalesce a request into a page list.
d8a5ad75
TM
272 * @desc: destination io descriptor
273 * @req: request
274 *
275 * Returns true if the request 'req' was successfully coalesced into the
276 * existing list of pages 'desc'.
277 */
bcb71bba
TM
278static int nfs_pageio_do_add_request(struct nfs_pageio_descriptor *desc,
279 struct nfs_page *req)
d8a5ad75
TM
280{
281 size_t newlen = req->wb_bytes;
282
283 if (desc->pg_count != 0) {
284 struct nfs_page *prev;
285
286 /*
287 * FIXME: ideally we should be able to coalesce all requests
288 * that are not block boundary aligned, but currently this
289 * is problematic for the case of bsize < PAGE_CACHE_SIZE,
290 * since nfs_flush_multi and nfs_pagein_multi assume you
291 * can have only one struct nfs_page.
292 */
8d5658c9
TM
293 if (desc->pg_bsize < PAGE_SIZE)
294 return 0;
d8a5ad75 295 newlen += desc->pg_count;
8d5658c9 296 if (newlen > desc->pg_bsize)
d8a5ad75
TM
297 return 0;
298 prev = nfs_list_entry(desc->pg_list.prev);
299 if (!nfs_can_coalesce_requests(prev, req))
300 return 0;
301 } else
302 desc->pg_base = req->wb_pgbase;
303 nfs_list_remove_request(req);
304 nfs_list_add_request(req, &desc->pg_list);
305 desc->pg_count = newlen;
306 return 1;
307}
308
bcb71bba
TM
309/*
310 * Helper for nfs_pageio_add_request and nfs_pageio_complete
311 */
312static void nfs_pageio_doio(struct nfs_pageio_descriptor *desc)
313{
314 if (!list_empty(&desc->pg_list)) {
315 int error = desc->pg_doio(desc->pg_inode,
316 &desc->pg_list,
8d5658c9
TM
317 nfs_page_array_len(desc->pg_base,
318 desc->pg_count),
bcb71bba
TM
319 desc->pg_count,
320 desc->pg_ioflags);
321 if (error < 0)
322 desc->pg_error = error;
323 else
324 desc->pg_bytes_written += desc->pg_count;
325 }
326 if (list_empty(&desc->pg_list)) {
327 desc->pg_count = 0;
328 desc->pg_base = 0;
329 }
330}
331
332/**
333 * nfs_pageio_add_request - Attempt to coalesce a request into a page list.
334 * @desc: destination io descriptor
335 * @req: request
336 *
337 * Returns true if the request 'req' was successfully coalesced into the
338 * existing list of pages 'desc'.
339 */
8b09bee3
TM
340int nfs_pageio_add_request(struct nfs_pageio_descriptor *desc,
341 struct nfs_page *req)
bcb71bba
TM
342{
343 while (!nfs_pageio_do_add_request(desc, req)) {
344 nfs_pageio_doio(desc);
345 if (desc->pg_error < 0)
346 return 0;
347 }
348 return 1;
349}
350
bcb71bba
TM
351/**
352 * nfs_pageio_complete - Complete I/O on an nfs_pageio_descriptor
353 * @desc: pointer to io descriptor
354 */
355void nfs_pageio_complete(struct nfs_pageio_descriptor *desc)
356{
357 nfs_pageio_doio(desc);
358}
359
7fe7f848
TM
360/**
361 * nfs_pageio_cond_complete - Conditional I/O completion
362 * @desc: pointer to io descriptor
363 * @index: page index
364 *
365 * It is important to ensure that processes don't try to take locks
366 * on non-contiguous ranges of pages as that might deadlock. This
367 * function should be called before attempting to wait on a locked
368 * nfs_page. It will complete the I/O if the page index 'index'
369 * is not contiguous with the existing list of pages in 'desc'.
370 */
371void nfs_pageio_cond_complete(struct nfs_pageio_descriptor *desc, pgoff_t index)
372{
373 if (!list_empty(&desc->pg_list)) {
374 struct nfs_page *prev = nfs_list_entry(desc->pg_list.prev);
375 if (index != prev->wb_index + 1)
376 nfs_pageio_doio(desc);
377 }
378}
379
3da28eb1 380#define NFS_SCAN_MAXENTRIES 16
1da177e4
LT
381/**
382 * nfs_scan_list - Scan a list for matching requests
d2ccddf0 383 * @nfsi: NFS inode
1da177e4
LT
384 * @dst: Destination list
385 * @idx_start: lower bound of page->index to scan
386 * @npages: idx_start + npages sets the upper bound to scan.
5c369683 387 * @tag: tag to scan for
1da177e4
LT
388 *
389 * Moves elements from one of the inode request lists.
390 * If the number of requests is set to 0, the entire address_space
391 * starting at index idx_start, is scanned.
392 * The requests are *not* checked to ensure that they form a contiguous set.
393 * You must be holding the inode's req_lock when calling this function
394 */
5c369683 395int nfs_scan_list(struct nfs_inode *nfsi,
ca52fec1 396 struct list_head *dst, pgoff_t idx_start,
5c369683 397 unsigned int npages, int tag)
1da177e4 398{
d2ccddf0
TM
399 struct nfs_page *pgvec[NFS_SCAN_MAXENTRIES];
400 struct nfs_page *req;
ca52fec1 401 pgoff_t idx_end;
d2ccddf0
TM
402 int found, i;
403 int res;
1da177e4
LT
404
405 res = 0;
406 if (npages == 0)
407 idx_end = ~0;
408 else
409 idx_end = idx_start + npages - 1;
410
d2ccddf0 411 for (;;) {
5c369683 412 found = radix_tree_gang_lookup_tag(&nfsi->nfs_page_tree,
d2ccddf0 413 (void **)&pgvec[0], idx_start,
5c369683 414 NFS_SCAN_MAXENTRIES, tag);
d2ccddf0 415 if (found <= 0)
1da177e4 416 break;
d2ccddf0
TM
417 for (i = 0; i < found; i++) {
418 req = pgvec[i];
419 if (req->wb_index > idx_end)
420 goto out;
421 idx_start = req->wb_index + 1;
9fd367f0 422 if (nfs_set_page_tag_locked(req)) {
d2ccddf0 423 nfs_list_remove_request(req);
5c369683
TM
424 radix_tree_tag_clear(&nfsi->nfs_page_tree,
425 req->wb_index, tag);
d2ccddf0
TM
426 nfs_list_add_request(req, dst);
427 res++;
dce34ce2
TM
428 if (res == INT_MAX)
429 goto out;
d2ccddf0
TM
430 }
431 }
1da177e4 432
1da177e4 433 }
d2ccddf0 434out:
1da177e4
LT
435 return res;
436}
437
f7b422b1 438int __init nfs_init_nfspagecache(void)
1da177e4
LT
439{
440 nfs_page_cachep = kmem_cache_create("nfs_page",
441 sizeof(struct nfs_page),
442 0, SLAB_HWCACHE_ALIGN,
443 NULL, NULL);
444 if (nfs_page_cachep == NULL)
445 return -ENOMEM;
446
447 return 0;
448}
449
266bee88 450void nfs_destroy_nfspagecache(void)
1da177e4 451{
1a1d92c1 452 kmem_cache_destroy(nfs_page_cachep);
1da177e4
LT
453}
454