Bug #4603
closedceph: writeback pagevec pool is created incorrectly
0%
Description
In ceph_writepages_start() if there are any pages to write back
an array of page pointers is needed, sufficient to hold pointes
to as many pages as are required to satisfy the minimum I/O size
for the inode (or the file system containing it).
If a "normal" kmalloc() request fails to allocate the array,
a memory pool associated with the file system client is used.
The memory pool is created in create_fs_client(), and its size
parameter is computed incorrectly in two ways:
- it uses fsc->mount_options->wsize >> PAGE_CACHE_SHIFT, to
determine how many pages should be supported for a request; and
- the size supplied is supposed to be a multiple of the size
of a page pointer, but it's the count of pages.
The first can be a problem because the wsize parameter could
be less than PAGE_SIZE (including 0), but we will always need
to support writing at least one page. This might not be a
real problem in practice.
The second problem is serious though. The argument value needs
to be the product of the page count and the size of a page pointer.
I have a fix for this, I'm just documenting the problem.