imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-31 14:23:49 +01:00
Code Issues Packages Projects Releases Wiki Activity

io_uring: fix dangling iovec after provided-buffer bundle grow failure

Browse Source 
When growing a provided-buffer bundle, the old cached iovec is freed
before the new buffers have all been validated. If validation fails, the
request still points at the freed iovec, which can be freed again during
completion cleanup.

Fix this by deferring the free of the old cached iovec until validation
has succeeded. On failure, free the newly allocated iovec and leave the
request pointing at the original one.

Fixes: 46800585ae ("io_uring/kbuf: validate ring provided buffer addresses with access_ok()")
Signed-off-by: Hao-Yu Yang <[email protected]>
Link: https://patch.msgid.link/[email protected]
Suggested-by: Jens Axboe <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>
This commit is contained in:
Hao-Yu Yang authored and Jens Axboe committed 2026-07-06 18:49:37 -06:00
1 parent 58481c749c
commit cd053d788c
1 file changed
+3 -2
Download Patch File Download Diff File Expand all files Collapse all files
io_uring/kbuf.c
+3 -2
View File
@@ -287,8 +287,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
iov = kmalloc_objs(struct iovec, nr_avail);
if (unlikely(!iov))
return -ENOMEM;
if (arg->mode & KBUF_MODE_FREE)
kfree(arg->iovs);
arg->iovs = iov;
nr_iovs = nr_avail;
} else if (nr_avail < nr_iovs) {
@@ -330,6 +328,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
buf = io_ring_head_to_buf(br, ++head, bl->mask);
} while (--nr_iovs);
if (arg->mode & KBUF_MODE_FREE)
kfree(arg->iovs);
if (head == tail)
req->flags |= REQ_F_BL_EMPTY;