diff options
| author | Penglei Jiang <superman.xpt@gmail.com> | 2025-06-25 13:27:03 +0300 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-06-25 17:14:14 +0300 |
| commit | 7cac633a42a7b3c8146eb1db76fb80dc652998de (patch) | |
| tree | 375fce3a8e323d8eb92b5b769a961190c5c79967 | |
| parent | e1d7727b73a1f78035316ac35ee184d477059f0b (diff) | |
| download | linux-7cac633a42a7b3c8146eb1db76fb80dc652998de.tar.xz | |
io_uring: fix resource leak in io_import_dmabuf()
Replace the return statement with setting ret = -EINVAL and jumping to
the err label to ensure resources are released via io_release_dmabuf.
Fixes: a5c98e942457 ("io_uring/zcrx: dmabuf backed zerocopy receive")
Signed-off-by: Penglei Jiang <superman.xpt@gmail.com>
Link: https://lore.kernel.org/r/20250625102703.68336-1-superman.xpt@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
| -rw-r--r-- | io_uring/zcrx.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index 21c816c3bfe0..ade4da9c4e31 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -106,8 +106,10 @@ static int io_import_dmabuf(struct io_zcrx_ifq *ifq, for_each_sgtable_dma_sg(mem->sgt, sg, i) total_size += sg_dma_len(sg); - if (total_size < off + len) - return -EINVAL; + if (total_size < off + len) { + ret = -EINVAL; + goto err; + } mem->dmabuf_offset = off; mem->size = len; |