diff options
| author | Al Viro <viro@zeniv.linux.org.uk> | 2022-06-05 20:01:42 +0200 |
|---|---|---|
| committer | Al Viro <viro@zeniv.linux.org.uk> | 2022-06-05 21:03:03 +0200 |
| commit | 40a1926022d128057376d35167128a7c74e3dca4 (patch) | |
| tree | b58c10d4ef49365fece9ccd5e49974ce8e03d747 /fs/io_uring.c | |
| parent | Unify the primitives for file descriptor closing (diff) | |
| download | linux-40a1926022d128057376d35167128a7c74e3dca4.tar.xz linux-40a1926022d128057376d35167128a7c74e3dca4.zip | |
fix the breakage in close_fd_get_file() calling conventions change
It used to grab an extra reference to struct file rather than
just transferring to caller the one it had removed from descriptor
table. New variant doesn't, and callers need to be adjusted.
Reported-and-tested-by: syzbot+47dd250f527cb7bebf24@syzkaller.appspotmail.com
Fixes: 6319194ec57b ("Unify the primitives for file descriptor closing")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Diffstat (limited to '')
| -rw-r--r-- | fs/io_uring.c | 5 |
1 files changed, 1 insertions, 4 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 7257b0870353..33da5116cc38 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -5110,7 +5110,7 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags) struct files_struct *files = current->files; struct io_close *close = &req->close; struct fdtable *fdt; - struct file *file = NULL; + struct file *file; int ret = -EBADF; if (req->close.file_slot) { @@ -5127,7 +5127,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags) file = fdt->fd[close->fd]; if (!file || file->f_op == &io_uring_fops) { spin_unlock(&files->file_lock); - file = NULL; goto err; } @@ -5147,8 +5146,6 @@ static int io_close(struct io_kiocb *req, unsigned int issue_flags) err: if (ret < 0) req_set_fail(req); - if (file) - fput(file); __io_req_complete(req, issue_flags, ret, 0); return 0; } |