diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2022-04-06 14:43:58 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-13 21:59:20 +0300 |
| commit | 285f5d724005758a8b215fa0a9ef3e282d646edb (patch) | |
| tree | 3ebbbd23ffc94a3b7220f04ceb27af0066a20993 | |
| parent | 50c981bd77900293c32f91b3d28344554a5f3c0b (diff) | |
| download | linux-285f5d724005758a8b215fa0a9ef3e282d646edb.tar.xz | |
io_uring: don't touch scm_fp_list after queueing skb
[ Upstream commit a07211e3001435fe8591b992464cd8d5e3c98c5a ]
It's safer to not touch scm_fp_list after we queued an skb to which it
was assigned, there might be races lurking if we screw subtle sync
guarantees on the io_uring side.
Fixes: 6b06314c47e14 ("io_uring: add file set registration")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | fs/io_uring.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 21823d1e91de..2faa558778ba 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8126,8 +8126,12 @@ static int __io_sqe_files_scm(struct io_ring_ctx *ctx, int nr, int offset) refcount_add(skb->truesize, &sk->sk_wmem_alloc); skb_queue_head(&sk->sk_receive_queue, skb); - for (i = 0; i < nr_files; i++) - fput(fpl->fp[i]); + for (i = 0; i < nr; i++) { + struct file *file = io_file_from_index(ctx, i + offset); + + if (file) + fput(file); + } } else { kfree_skb(skb); free_uid(fpl->user); |