On 19/02/2020 00:19, Pavel Begunkov wrote:
> io_cleanup_req() should be called before req->io is freed, and so
> shouldn't be after __io_free_req() -> __io_req_aux_free(). Also,
> it will be ignored for in io_free_req_many(), which use
> __io_req_aux_free().
My bad, this got into rc2, and should be pretty easy to hit.
Please, patch this up.
> Place cleanup_req() into __io_req_aux_free().
>
> Fixes: 99bc4c38537d774 ("io_uring: fix iovec leaks")
> Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
> ---
> fs/io_uring.c | 6 +++---
> 1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 11627818104e..c39a81f8f83d 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -1296,6 +1296,9 @@ static void __io_req_aux_free(struct io_kiocb *req)
> {
> struct io_ring_ctx *ctx = req->ctx;
>
> + if (req->flags & REQ_F_NEED_CLEANUP)
> + io_cleanup_req(req);
> +
> kfree(req->io);
> if (req->file)
> io_put_file(ctx, req->file, (req->flags & REQ_F_FIXED_FILE));
> @@ -1307,9 +1310,6 @@ static void __io_free_req(struct io_kiocb *req)
> {
> __io_req_aux_free(req);
>
> - if (req->flags & REQ_F_NEED_CLEANUP)
> - io_cleanup_req(req);
> -
> if (req->flags & REQ_F_INFLIGHT) {
> struct io_ring_ctx *ctx = req->ctx;
> unsigned long flags;
>
--
Pavel Begunkov
Attachment:
signature.asc
Description: OpenPGP digital signature
