diff options
| author | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-12 14:31:38 +0100 |
|---|---|---|
| committer | Pavel Begunkov <asml.silence@gmail.com> | 2022-06-13 11:37:41 +0100 |
| commit | fc9375e3f763b06c3c90c5f5b2b84d3e07c1f4c2 (patch) | |
| tree | 95b6dbbedc00d45624607ccf41895d64cbac241c /fs/io_uring.c | |
| parent | 42db0c00e275877eb92480beaa16b33507dc3bda (diff) | |
| download | lwn-fc9375e3f763b06c3c90c5f5b2b84d3e07c1f4c2.tar.gz lwn-fc9375e3f763b06c3c90c5f5b2b84d3e07c1f4c2.zip | |
io_uring: fix double unlock for pbuf select
io_buffer_select(), which is the only caller of io_ring_buffer_select(),
fully handles locking, mutex unlock in io_ring_buffer_select() will lead
to double unlock.
Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 4 |
1 files changed, 1 insertions, 3 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 84b45ed91b2d..4719eaee3b45 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3849,10 +3849,8 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len, struct io_uring_buf *buf; __u32 head = bl->head; - if (unlikely(smp_load_acquire(&br->tail) == head)) { - io_ring_submit_unlock(req->ctx, issue_flags); + if (unlikely(smp_load_acquire(&br->tail) == head)) return NULL; - } head &= bl->mask; if (head < IO_BUFFER_LIST_BUF_PER_PAGE) { |