Commit e6cb007c authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: zero ref_node after killing it 



After a rsrc/files reference node's refs are killed, it must never be
used. And that's how it works, it either assigns a new node or kills the
whole data table.

Let's explicitly NULL it, that shouldn't be necessary, but if something
would go wrong I'd rather catch a NULL dereference to using a dangling
pointer.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 99a10081

fs/io_uring.c

+1 −0
Original line number Diff line number Diff line
@@ -7299,6 +7299,7 @@ static void io_sqe_rsrc_kill_node(struct io_ring_ctx *ctx, struct fixed_rsrc_dat 


	io_rsrc_ref_lock(ctx);

	ref_node = data->node;

	data->node = NULL;

	io_rsrc_ref_unlock(ctx);

	if (ref_node)

		percpu_ref_kill(&ref_node->refs);