On 8/11/22 9:38 AM, Jens Axboe wrote:
> On Thu, 11 Aug 2022 14:44:59 +0530, Anuj Gupta wrote:
>> Commit 97b388d70b53 ("io_uring: handle completions in the core") moved the
>> error handling from handler to core. But for io_uring_cmd handler we end
>> up completing more than once (both in handler and in core) leading to
>> use_after_free.
>> Change io_uring_cmd handler to avoid calling io_uring_cmd_done in case
>> of error.
>>
>> [...]
>
> Applied, thanks!
>
> [1/1] io_uring: fix error handling for io_uring_cmd
> commit: f1bb0fd63c374e1410ff05fb434aa78e1ce09ae4
Ehm, did you compile this:
> io_uring/uring_cmd.c: In function ?io_uring_cmd?:
io_uring/uring_cmd.c:113:38: warning: passing argument 1 of ?req_set_fail? makes pointer from integer without a cast [-Wint-conversion]
113 | req_set_fail(ret);
| ^~~
| |
| int
In file included from io_uring/uring_cmd.c:9:
io_uring/io_uring.h:144:50: note: expected ?struct io_kiocb *? but argument is of type ?int?
144 | static inline void req_set_fail(struct io_kiocb *req)
| ~~~~~~~~~~~~~~~~~^~~
s/ret/req obviously.
--
Jens Axboe
