On 7/14/19 1:08 PM, Bharath Vedartham wrote: > diff --git a/fs/io_uring.c b/fs/io_uring.c > index 4ef62a4..b4a4549 100644 > --- a/fs/io_uring.c > +++ b/fs/io_uring.c > @@ -2694,10 +2694,9 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg, > * if we did partial map, or found file backed vmas, > * release any pages we did get > */ > - if (pret > 0) { > - for (j = 0; j < pret; j++) > - put_page(pages[j]); > - } > + if (pret > 0) > + put_user_pages(pages, pret); > + > if (ctx->account_mem) > io_unaccount_mem(ctx->user, nr_pages); > kvfree(imu->bvec); You handled just the failure case of the buffer registration, but not the actual free in io_sqe_buffer_unregister(). -- Jens Axboe