Commit a5235996 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block 

Pull io_uring fixes from Jens Axboe:
 "Fix for a bad kfree() introduced in this cycle, and a quick fix for
  disabling buffer recycling for IORING_OP_READV.

  The latter will get reworked for 5.20, but it gets the job done for
  5.19"

* tag 'io_uring-5.19-2022-07-21' of git://git.kernel.dk/linux-block:
  io_uring: do not recycle buffer in READV
  io_uring: fix free of unallocated buffer list
parents d945404f 934447a6

fs/io_uring.c

+11 −3
Original line number Diff line number Diff line
@@ -1737,6 +1737,14 @@ static void io_kbuf_recycle(struct io_kiocb *req, unsigned issue_flags) 
	    (req->flags & REQ_F_PARTIAL_IO))

		return;



	/*

	 * READV uses fields in `struct io_rw` (len/addr) to stash the selected

	 * buffer data. However if that buffer is recycled the original request

	 * data stored in addr is lost. Therefore forbid recycling for now.

	 */

	if (req->opcode == IORING_OP_READV)

		return;



	/*

	 * We don't need to recycle for REQ_F_BUFFER_RING, we can just clear

	 * the flag and hence ensure that bl->head doesn't get incremented.
@@ -12931,7 +12939,7 @@ static int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) 
{

	struct io_uring_buf_ring *br;

	struct io_uring_buf_reg reg;

	struct io_buffer_list *bl;

	struct io_buffer_list *bl, *free_bl = NULL;

	struct page **pages;

	int nr_pages;
@@ -12963,7 +12971,7 @@ static int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) 
		if (bl->buf_nr_pages || !list_empty(&bl->buf_list))

			return -EEXIST;

	} else {

		bl = kzalloc(sizeof(*bl), GFP_KERNEL);

		free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL);

		if (!bl)

			return -ENOMEM;

	}
@@ -12972,7 +12980,7 @@ static int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg) 
			     struct_size(br, bufs, reg.ring_entries),

			     &nr_pages);

	if (IS_ERR(pages)) {

		kfree(bl);

		kfree(free_bl);

		return PTR_ERR(pages);

	}