diff options
| author | Jens Axboe <axboe@kernel.dk> | 2022-05-26 19:34:33 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2022-05-31 10:50:06 +0200 |
| commit | 21870e02fcd385c39fe635e6531ce78302f3cd71 (patch) | |
| tree | 48e100de76ae52bd15636ea49492ddaefe82f862 /fs | |
| parent | io_uring: move shutdown under the general net section (diff) | |
| download | linux-21870e02fcd385c39fe635e6531ce78302f3cd71.tar.xz linux-21870e02fcd385c39fe635e6531ce78302f3cd71.zip | |
io_uring: fix a memory leak of buffer group list on exit
If we use a buffer group ID that is large enough to require io_uring
to allocate it, then we don't correctly free it if the cleanup is
deferred to the ring exit. The explicit removal paths are fine.
Fixes: 9cfc7e94e42b ("io_uring: get rid of hashed provided buffer groups")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index ae2cc17edd2c..f14ebe4bb65d 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -11065,6 +11065,7 @@ static void io_destroy_buffers(struct io_ring_ctx *ctx) xa_for_each(&ctx->io_bl_xa, index, bl) { xa_erase(&ctx->io_bl_xa, bl->bgid); __io_remove_buffers(ctx, bl, -1U); + kfree(bl); } while (!list_empty(&ctx->io_buffers_pages)) { |