diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2026-04-21 11:45:29 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-04-21 21:19:11 +0300 |
| commit | 770594e78c3964cf23cf5287f849437cdde9b7d0 (patch) | |
| tree | 049720abba71df2a84ea9d6da94c5247cedddfed | |
| parent | 4f02cc4071a18c78bfff571d796edef055d57daa (diff) | |
| download | linux-770594e78c3964cf23cf5287f849437cdde9b7d0.tar.xz | |
io_uring/zcrx: warn on freelist violations
The freelist is appropriately sized to always be able to take a free
niov, but let's be more defensive and check the invariant with a
warning. That should help to catch any double-free issues.
Suggested-by: Kai Aizen <kai@snailsploit.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://patch.msgid.link/2f3cea363b04649755e3b6bb9ab66485a95936d5.1776760901.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/zcrx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 2eb09219f0a0..7b93c87b8371 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -602,6 +602,8 @@ static void io_zcrx_return_niov_freelist(struct net_iov *niov) struct io_zcrx_area *area = io_zcrx_iov_to_area(niov); guard(spinlock_bh)(&area->freelist_lock); + if (WARN_ON_ONCE(area->free_count >= area->nia.num_niovs)) + return; area->freelist[area->free_count++] = net_iov_idx(niov); } |