diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-04-26 15:17:38 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-04-26 09:03:57 -0600 |
| commit | 0b8c0e7c9692cfcfa02c9052d4d53ae67901c400 (patch) | |
| tree | aecf19946187f5912d04a7156f16017b1b96f891 /fs/io_uring.c | |
| parent | 9f59a9d88d3bb2708d08e0e1d03899c469c27190 (diff) | |
io_uring: fix NULL reg-buffer
io_import_fixed() doesn't expect a registered buffer slot to be NULL and
would fail stumbling on it. We don't allow it, but if during
__io_sqe_buffers_update() rsrc removal succeeds but following register
fails, we'll get such a situation.
Do it atomically and don't remove buffers until we sure that a new one
can be set.
Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/830020f9c387acddd51962a3123b5566571b8c6d.1619446608.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 34 |
1 files changed, 17 insertions, 17 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 6b578c380e73..863420e184cf 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8419,7 +8419,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, { u64 __user *tags = u64_to_user_ptr(up->tags); struct iovec iov, __user *iovs = u64_to_user_ptr(up->data); - struct io_mapped_ubuf *imu; struct page *last_hpage = NULL; bool needs_switch = false; __u32 done; @@ -8431,6 +8430,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, return -EINVAL; for (done = 0; done < nr_args; done++) { + struct io_mapped_ubuf *imu; + int offset = up->offset + done; u64 tag = 0; err = io_copy_iov(ctx, &iov, iovs, done); @@ -8440,28 +8441,27 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, err = -EFAULT; break; } + err = io_buffer_validate(&iov); + if (err) + break; + err = io_sqe_buffer_register(ctx, &iov, &imu, &last_hpage); + if (err) + break; - i = array_index_nospec(up->offset + done, ctx->nr_user_bufs); - imu = ctx->user_bufs[i]; - if (imu) { - err = io_queue_rsrc_removal(ctx->buf_data, up->offset + done, - ctx->rsrc_node, imu); - if (err) + i = array_index_nospec(offset, ctx->nr_user_bufs); + if (ctx->user_bufs[i]) { + err = io_queue_rsrc_removal(ctx->buf_data, offset, + ctx->rsrc_node, ctx->user_bufs[i]); + if (unlikely(err)) { + io_buffer_unmap(ctx, &imu); break; + } ctx->user_bufs[i] = NULL; needs_switch = true; } - if (iov.iov_base || iov.iov_len) { - err = io_buffer_validate(&iov); - if (err) - break; - err = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i], - &last_hpage); - if (err) - break; - ctx->buf_data->tags[up->offset + done] = tag; - } + ctx->user_bufs[i] = imu; + ctx->buf_data->tags[offset] = tag; } if (needs_switch) |