diff options
| author | Matthew Wilcox (Oracle) <willy@infradead.org> | 2020-10-09 13:49:52 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2020-10-09 08:59:40 -0600 |
| commit | 236434c3438c4da3dfbd6aeeab807577b85e951a (patch) | |
| tree | 4db44a68993f532093236a4e0692f3ce79241fce | |
| parent | ce765372bc443573d1d339a2bf4995de385dea3a (diff) | |
| download | linux-236434c3438c4da3dfbd6aeeab807577b85e951a.tar.gz | |
io_uring: Fix XArray usage in io_uring_add_task_file
The xas_store() wasn't paired with an xas_nomem() loop, so if it couldn't
allocate memory using GFP_NOWAIT, it would leak the reference to the file
descriptor. Also the node pointed to by the xas could be freed between
the call to xas_load() under the rcu_read_lock() and the acquisition of
the xa_lock.
It's easier to just use the normal xa_load/xa_store interface here.
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[axboe: fix missing assign after alloc, cur_uring -> tctx rename]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | fs/io_uring.c | 21 |
1 files changed, 9 insertions, 12 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 2978cc78538ade..13fc60ab04909a 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8586,27 +8586,24 @@ static void io_uring_cancel_task_requests(struct io_ring_ctx *ctx, */ static int io_uring_add_task_file(struct file *file) { - if (unlikely(!current->io_uring)) { + struct io_uring_task *tctx = current->io_uring; + + if (unlikely(!tctx)) { int ret; ret = io_uring_alloc_task_context(current); if (unlikely(ret)) return ret; + tctx = current->io_uring; } - if (current->io_uring->last != file) { - XA_STATE(xas, ¤t->io_uring->xa, (unsigned long) file); - void *old; + if (tctx->last != file) { + void *old = xa_load(&tctx->xa, (unsigned long)file); - rcu_read_lock(); - old = xas_load(&xas); - if (old != file) { + if (!old) { get_file(file); - xas_lock(&xas); - xas_store(&xas, file); - xas_unlock(&xas); + xa_store(&tctx->xa, (unsigned long)file, file, GFP_KERNEL); } - rcu_read_unlock(); - current->io_uring->last = file; + tctx->last = file; } return 0; |