Commit 0cc936f7 authored by Jens Axboe's avatar Jens Axboe
Browse files

io_uring: fix early fdput() of file 

A previous commit shuffled some code around, and inadvertently used
struct file after fdput() had been called on it. As we can't touch
the file post fdput() dropping our reference, move the fdput() to
after that has been done.

Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/io-uring/YPnqM0fY3nM5RdRI@zeniv-ca.linux.org.uk/


Fixes: f2a48dd0 ("io_uring: refactor io_sq_offload_create()")
Reported-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 362a9e65

fs/io_uring.c

+4 −2
Original line number Diff line number Diff line
@@ -7991,10 +7991,12 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, 
		f = fdget(p->wq_fd);

		if (!f.file)

			return -ENXIO;

		if (f.file->f_op != &io_uring_fops) {

			fdput(f);

		if (f.file->f_op != &io_uring_fops)

			return -EINVAL;

		}

		fdput(f);

	}

	if (ctx->flags & IORING_SETUP_SQPOLL) {

		struct task_struct *tsk;

		struct io_sq_data *sqd;