Commit de75a3d3 authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: don't leak creds on SQO attach error 



Attaching to already dead/dying SQPOLL task is disallowed in
io_sq_offload_create(), but cleanup is hand coded by calling
io_put_sq_data()/etc., that miss to put ctx->sq_creds.

Defer everything to error-path io_sq_thread_finish(), adding
ctx->sqd_list in the error case as well as finish will handle it.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent ee53fb2b

fs/io_uring.c

+6 −11
Original line number Diff line number Diff line
@@ -7910,22 +7910,17 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, 


		ret = 0;

		io_sq_thread_park(sqd);

		/* don't attach to a dying SQPOLL thread, would be racy */

		if (attached && !sqd->thread) {

			ret = -ENXIO;

		} else {

		list_add(&ctx->sqd_list, &sqd->ctx_list);

		io_sqd_update_thread_idle(sqd);

		}

		/* don't attach to a dying SQPOLL thread, would be racy */

		if (attached && !sqd->thread)

			ret = -ENXIO;

		io_sq_thread_unpark(sqd);



		if (ret < 0) {

			io_put_sq_data(sqd);

			ctx->sq_data = NULL;

			return ret;

		} else if (attached) {

		if (ret < 0)

			goto err;

		if (attached)

			return 0;

		}



		if (p->flags & IORING_SETUP_SQ_AFF) {

			int cpu = p->sq_thread_cpu;