Commit 1f5e98e7 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-5.18-2022-04-22' of git://git.kernel.dk/linux-block 

Pull io_uring fixes from Jens Axboe:
 "Just two small fixes - one fixing a potential leak for the iovec for
  larger requests added in this cycle, and one fixing a theoretical leak
  with CQE_SKIP and IOPOLL"

* tag 'io_uring-5.18-2022-04-22' of git://git.kernel.dk/linux-block:
  io_uring: fix leaks on IOPOLL and CQE_SKIP
  io_uring: free iovec if file assignment fails
parents 45ab9400 c0713540

fs/io_uring.c

+7 −4
Original line number Diff line number Diff line
@@ -2797,11 +2797,10 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin) 
		/* order with io_complete_rw_iopoll(), e.g. ->result updates */

		if (!smp_load_acquire(&req->iopoll_completed))

			break;

		nr_events++;

		if (unlikely(req->flags & REQ_F_CQE_SKIP))

			continue;



		__io_fill_cqe_req(req, req->result, io_put_kbuf(req, 0));

		nr_events++;

	}



	if (unlikely(!nr_events))
@@ -3832,8 +3831,10 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags) 
		iovec = NULL;

	}

	ret = io_rw_init_file(req, FMODE_READ);

	if (unlikely(ret))

	if (unlikely(ret)) {

		kfree(iovec);

		return ret;

	}

	req->result = iov_iter_count(&s->iter);



	if (force_nonblock) {
@@ -3958,8 +3959,10 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags) 
		iovec = NULL;

	}

	ret = io_rw_init_file(req, FMODE_WRITE);

	if (unlikely(ret))

	if (unlikely(ret)) {

		kfree(iovec);

		return ret;

	}

	req->result = iov_iter_count(&s->iter);



	if (force_nonblock) {