Commit 0b8c0e7c authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: fix NULL reg-buffer 



io_import_fixed() doesn't expect a registered buffer slot to be NULL and
would fail stumbling on it. We don't allow it, but if during
__io_sqe_buffers_update() rsrc removal succeeds but following register
fails, we'll get such a situation.

Do it atomically and don't remove buffers until we sure that a new one
can be set.

Fixes: 634d00df ("io_uring: add full-fledged dynamic buffers support")
Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/830020f9c387acddd51962a3123b5566571b8c6d.1619446608.git.asml.silence@gmail.com


Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 9f59a9d8

fs/io_uring.c

+17 −17
Original line number Diff line number Diff line
@@ -8419,7 +8419,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, 
{

	u64 __user *tags = u64_to_user_ptr(up->tags);

	struct iovec iov, __user *iovs = u64_to_user_ptr(up->data);

	struct io_mapped_ubuf *imu;

	struct page *last_hpage = NULL;

	bool needs_switch = false;

	__u32 done;
@@ -8431,6 +8430,8 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, 
		return -EINVAL;



	for (done = 0; done < nr_args; done++) {

		struct io_mapped_ubuf *imu;

		int offset = up->offset + done;

		u64 tag = 0;



		err = io_copy_iov(ctx, &iov, iovs, done);
@@ -8440,28 +8441,27 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx, 
			err = -EFAULT;

			break;

		}



		i = array_index_nospec(up->offset + done, ctx->nr_user_bufs);

		imu = ctx->user_bufs[i];

		if (imu) {

			err = io_queue_rsrc_removal(ctx->buf_data, up->offset + done,

						    ctx->rsrc_node, imu);

			if (err)

				break;

			ctx->user_bufs[i] = NULL;

			needs_switch = true;

		}



		if (iov.iov_base || iov.iov_len) {

		err = io_buffer_validate(&iov);

		if (err)

			break;

			err = io_sqe_buffer_register(ctx, &iov, &ctx->user_bufs[i],

						     &last_hpage);

		err = io_sqe_buffer_register(ctx, &iov, &imu, &last_hpage);

		if (err)

			break;

			ctx->buf_data->tags[up->offset + done] = tag;



		i = array_index_nospec(offset, ctx->nr_user_bufs);

		if (ctx->user_bufs[i]) {

			err = io_queue_rsrc_removal(ctx->buf_data, offset,

						    ctx->rsrc_node, ctx->user_bufs[i]);

			if (unlikely(err)) {

				io_buffer_unmap(ctx, &imu);

				break;

			}

			ctx->user_bufs[i] = NULL;

			needs_switch = true;

		}



		ctx->user_bufs[i] = imu;

		ctx->buf_data->tags[offset] = tag;

	}



	if (needs_switch)