io_uring: set ctx sq/cq entry count earlier (bd740481) · Commits · 戴 / test

If we hit an earlier error path in io_uring_create(), then we will have accounted memory, but not set ctx->{sq,cq}_entries yet. Then when the ring is torn down in error, we use those values to unaccount the memory. Ensure we set the ctx entries before we're able to hit a potential error path. Cc: stable@vger.kernel.org Reported-by:

Tomáš Chaloupka <chalucha@gmail.com> Tested-by:

Tomáš Chaloupka <chalucha@gmail.com> Reviewed-by:

Stefano Garzarella <sgarzare@redhat.com> Signed-off-by:

Jens Axboe <axboe@kernel.dk>

fs/io_uring.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -8193,6 +8193,10 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx,
		struct io_rings *rings;
		size_t size, sq_array_offset;

		/* make sure these are sane, as we already accounted them */
		ctx->sq_entries = p->sq_entries;
		ctx->cq_entries = p->cq_entries;

		size = rings_size(p->sq_entries, p->cq_entries, &sq_array_offset);
		if (size == SIZE_MAX)
		return -EOVERFLOW;
		@@ -8209,8 +8213,6 @@ static int io_allocate_scq_urings(struct io_ring_ctx *ctx,
		rings->cq_ring_entries = p->cq_entries;
		ctx->sq_mask = rings->sq_ring_mask;
		ctx->cq_mask = rings->cq_ring_mask;
		ctx->sq_entries = rings->sq_ring_entries;
		ctx->cq_entries = rings->cq_ring_entries;

		size = array_size(sizeof(struct io_uring_sqe), p->sq_entries);
		if (size == SIZE_MAX) {

Admin message