Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block
Pull io_uring fixes from Jens Axboe:
"Fix for a bad kfree() introduced in this cycle, and a quick fix for
disabling buffer recycling for IORING_OP_READV.
The latter will get reworked for 5.20, but it gets the job done for
5.19"
* tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block:
io_uring: do not recycle buffer in READV
io_uring: fix free of unallocated buffer list
+11
-3
+11
-3
fs/io_uring.c
+11
-3
fs/io_uring.c
···
1738
1738
return;
1739
1739
1740
1740
/*
1741
+
* READV uses fields in `struct io_rw` (len/addr) to stash the selected
1742
+
* buffer data. However if that buffer is recycled the original request
1743
+
* data stored in addr is lost. Therefore forbid recycling for now.
1744
+
*/
1745
+
if (req->opcode == IORING_OP_READV)
1746
+
return;
1747
+
1748
+
/*
1741
1749
* We don't need to recycle for REQ_F_BUFFER_RING, we can just clear
1742
1750
* the flag and hence ensure that bl->head doesn't get incremented.
1743
1751
* If the tail has already been incremented, hang on to it.
···
12939
12931
{
12940
12932
struct io_uring_buf_ring *br;
12941
12933
struct io_uring_buf_reg reg;
12942
-
struct io_buffer_list *bl;
12934
+
struct io_buffer_list *bl, *free_bl = NULL;
12943
12935
struct page **pages;
12944
12936
int nr_pages;
12945
12937
···
12971
12963
if (bl->buf_nr_pages || !list_empty(&bl->buf_list))
12972
12964
return -EEXIST;
12973
12965
} else {
12974
-
bl = kzalloc(sizeof(*bl), GFP_KERNEL);
12966
+
free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL);
12975
12967
if (!bl)
12976
12968
return -ENOMEM;
12977
12969
}
···
12980
12972
struct_size(br, bufs, reg.ring_entries),
12981
12973
&nr_pages);
12982
12974
if (IS_ERR(pages)) {
12983
-
kfree(bl);
12975
+
kfree(free_bl);
12984
12976
return PTR_ERR(pages);
12985
12977
}
12986
12978