On 4/30/19 10:30 AM, Mark Rutland wrote: > If io_allocate_scq_urings() fails to allocate an sq_* region, it will > call io_mem_free() for any previously allocated regions, but leave > dangling pointers to these regions in the ctx. Any regions which have > not yet been allocated are left NULL. Note that when returning > -EOVERFLOW, the previously allocated sq_ring is not freed, which appears > to be an unintentional leak. > > When io_allocate_scq_urings() fails, io_uring_create() will call > io_ring_ctx_wait_and_kill(), which calls io_mem_free() on all the sq_* > regions, assuming the pointers are valid and not NULL. > > This can result in pages being freed multiple times, which has been > observed to corrupt the page state, leading to subsequent fun. This can > also result in virt_to_page() on NULL, resulting in the use of bogus > page addresses, and yet more subsequent fun. The latter can be detected > with CONFIG_DEBUG_VIRTUAL on arm64. > > Adding a cleanup path to io_allocate_scq_urings() complicates the logic, > so let's leave it to io_ring_ctx_free() to consistently free these > pointers, and simplify the io_allocate_scq_urings() error paths. Looks good - applied, thanks. -- Jens Axboe
