summaryrefslogtreecommitdiff
path: root/fs
diff options
context:
space:
mode:
authorPavel Begunkov <asml.silence@gmail.com>2021-04-26 15:17:38 +0100
committerJens Axboe <axboe@kernel.dk>2021-04-26 09:03:57 -0600
commit0b8c0e7c9692cfcfa02c9052d4d53ae67901c400 (patch)
treeaecf19946187f5912d04a7156f16017b1b96f891 /fs
parent9f59a9d88d3bb2708d08e0e1d03899c469c27190 (diff)
io_uring: fix NULL reg-buffer
io_import_fixed() doesn't expect a registered buffer slot to be NULL and would fail stumbling on it. We don't allow it, but if during __io_sqe_buffers_update() rsrc removal succeeds but following register fails, we'll get such a situation. Do it atomically and don't remove buffers until we sure that a new one can be set. Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support") Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/830020f9c387acddd51962a3123b5566571b8c6d.1619446608.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
-rw-r--r--fs/io_uring.c34
1 files changed, 17 insertions, 17 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 6b578c380e73..863420e184cf 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8419,7 +8419,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
{
u64 __user *tags = u64_to_user_ptr(up->tags);
struct iovec iov, __user *iovs = u64_to_user_ptr(up->data);
- struct io_mapped_ubuf *imu;
struct page *last_hpage = NULL;
bool needs_switch = false;
__u32 done;
@@ -8431,6 +8430,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
return -EINVAL;
for (done = 0; done < nr_args; done++) {
+ struct io_mapped_ubuf *imu;
+ int offset = up->offset + done;
u64 tag = 0;
err = io_copy_iov(ctx, &iov, iovs, done);
@@ -8440,28 +8441,27 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
err = -EFAULT;
break;
}
+ err = io_buffer_validate(&iov);
+ if (err)
+ break;
+ err = io_sqe_buffer_register(ctx, &iov, &imu, &last_hpage);
+ if (err)
+ break;
- i = array_index_nospec(up->offset + done, ctx->nr_user_bufs);
- imu = ctx->user_bufs[i];
- if (imu) {
- err = io_queue_rsrc_removal(ctx->buf_data, up->offset + done,
- ctx->rsrc_node, imu);
- if (err)
+ i = array_index_nospec(offset, ctx->nr_user_bufs);
+ if (ctx->user_bufs[i]) {
+ err = io_queue_rsrc_removal(ctx->buf_data, offset,
+ ctx->rsrc_node, ctx->user_bufs[i]);
+ if (unlikely(err)) {
+ io_buffer_unmap(ctx, &imu);
break;
+ }
ctx->user_bufs[i] = NULL;
needs_switch = true;
}
- if (iov.iov_base || iov.iov_len) {
- err = io_buffer_validate(&iov);
- if (err)
- break;
- err = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i],
- &last_hpage);
- if (err)
- break;
- ctx->buf_data->tags[up->offset + done] = tag;
- }
+ ctx->user_bufs[i] = imu;
+ ctx->buf_data->tags[offset] = tag;
}
if (needs_switch)