diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2021-05-29 13:01:02 +0200 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2021-05-30 03:27:21 +0200 |
| commit | 216e5835966a709bb87a4d94a7343dd90ab0bd64 (patch) | |
| tree | c154aa986cc6fe04647f515b703be9ae5217d04f /fs | |
| parent | io_uring: fix data race to avoid potential NULL-deref (diff) | |
| download | linux-216e5835966a709bb87a4d94a7343dd90ab0bd64.tar.xz linux-216e5835966a709bb87a4d94a7343dd90ab0bd64.zip | |
io_uring: fix misaccounting fix buf pinned pages
As Andres reports "... io_sqe_buffer_register() doesn't initialize imu.
io_buffer_account_pin() does imu->acct_pages++, before calling
io_account_mem(ctx, imu->acct_pages).", leading to evevntual -ENOMEM.
Initialise the field.
Reported-by: Andres Freund <andres@anarazel.de>
Fixes: 41edf1a5ec967 ("io_uring: keep table of pointers to ubufs")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/438a6f46739ae5e05d9c75a0c8fa235320ff367c.1622285901.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 903458afd56c..42380ed563c4 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -8228,6 +8228,7 @@ static int io_buffer_account_pin(struct io_ring_ctx *ctx, struct page **pages, { int i, ret; + imu->acct_pages = 0; for (i = 0; i < nr_pages; i++) { if (!PageCompound(pages[i])) { imu->acct_pages++; |