diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-03-18 12:54:35 +0100 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-03-18 16:44:35 +0100 |
| commit | de75a3d3f5a14c9ab3c4883de3471d3c92a8ee78 (patch) | |
| tree | 825ae49269672936357ee4e265b31db25d6ecf64 /fs/io_uring.c | |
| parent | io_uring: use typesafe pointers in io_uring_task (diff) | |
| download | linux-de75a3d3f5a14c9ab3c4883de3471d3c92a8ee78.tar.xz linux-de75a3d3f5a14c9ab3c4883de3471d3c92a8ee78.zip | |
io_uring: don't leak creds on SQO attach error
Attaching to already dead/dying SQPOLL task is disallowed in
io_sq_offload_create(), but cleanup is hand coded by calling
io_put_sq_data()/etc., that miss to put ctx->sq_creds.
Defer everything to error-path io_sq_thread_finish(), adding
ctx->sqd_list in the error case as well as finish will handle it.
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to '')
| -rw-r--r-- | fs/io_uring.c | 17 |
1 files changed, 6 insertions, 11 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 675073966760..ea2d3e120555 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7910,22 +7910,17 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, ret = 0; io_sq_thread_park(sqd); + list_add(&ctx->sqd_list, &sqd->ctx_list); + io_sqd_update_thread_idle(sqd); /* don't attach to a dying SQPOLL thread, would be racy */ - if (attached && !sqd->thread) { + if (attached && !sqd->thread) ret = -ENXIO; - } else { - list_add(&ctx->sqd_list, &sqd->ctx_list); - io_sqd_update_thread_idle(sqd); - } io_sq_thread_unpark(sqd); - if (ret < 0) { - io_put_sq_data(sqd); - ctx->sq_data = NULL; - return ret; - } else if (attached) { + if (ret < 0) + goto err; + if (attached) return 0; - } if (p->flags & IORING_SETUP_SQ_AFF) { int cpu = p->sq_thread_cpu; |