[PATCH] io_uring: fix an IS_ERR() vs NULL check

[PATCH] io_uring: fix an IS_ERR() vs NULL check

[Dan Carpenter]

The alloc_fixed_file_ref_node() function never returns NULL, it returns
error pointers on error.

Fixes: 1ffc54220c44 ("io_uring: fix io_sqe_files_unregister() hangs")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 fs/io_uring.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index ca46f314640b..2234ce03034a 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -7255,8 +7255,8 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
 	if (!data)
 		return -ENXIO;
 	backup_node = alloc_fixed_file_ref_node(ctx);
-	if (!backup_node)
-		return -ENOMEM;
+	if (IS_ERR(backup_node))
+		return PTR_ERR(backup_node);
 
 	spin_lock_bh(&data->lock);
 	ref_node = data->node;
-- 
2.29.2

Re: [PATCH] io_uring: fix an IS_ERR() vs NULL check

[Pavel Begunkov]

On 06/01/2021 09:26, Dan Carpenter wrote:
> The alloc_fixed_file_ref_node() function never returns NULL, it returns
> error pointers on error.
> 
> Fixes: 1ffc54220c44 ("io_uring: fix io_sqe_files_unregister() hangs")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

thanks Dan,

Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
Cc: stable@vger.kernel.org # 5.6+

> ---
>  fs/io_uring.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index ca46f314640b..2234ce03034a 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -7255,8 +7255,8 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
>  	if (!data)
>  		return -ENXIO;
>  	backup_node = alloc_fixed_file_ref_node(ctx);
> -	if (!backup_node)
> -		return -ENOMEM;
> +	if (IS_ERR(backup_node))
> +		return PTR_ERR(backup_node);
>  
>  	spin_lock_bh(&data->lock);
>  	ref_node = data->node;
> 

-- 
Pavel Begunkov

Re: [PATCH] io_uring: fix an IS_ERR() vs NULL check

[Matthew Wilcox]

On Wed, Jan 06, 2021 at 12:32:45PM +0000, Pavel Begunkov wrote:
> On 06/01/2021 09:26, Dan Carpenter wrote:
> > The alloc_fixed_file_ref_node() function never returns NULL, it returns
> > error pointers on error.
> > 
> > Fixes: 1ffc54220c44 ("io_uring: fix io_sqe_files_unregister() hangs")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> 
> thanks Dan,
> 
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
> Cc: stable@vger.kernel.org # 5.6+

But the only error that alloc_fixed_file_ref_node() can return is
-ENOMEM, so I think it'd be better to actually return NULL for errors.
It makes the other callers simpler:

+++ b/fs/io_uring.c
@@ -7684,12 +7684,12 @@ static struct fixed_file_ref_node *alloc_fixed_file_ref_node(
 
        ref_node = kzalloc(sizeof(*ref_node), GFP_KERNEL);
        if (!ref_node)
-               return ERR_PTR(-ENOMEM);
+               return NULL;
 
        if (percpu_ref_init(&ref_node->refs, io_file_data_ref_zero,
                            0, GFP_KERNEL)) {
                kfree(ref_node);
-               return ERR_PTR(-ENOMEM);
+               return NULL;
        }
        INIT_LIST_HEAD(&ref_node->node);
        INIT_LIST_HEAD(&ref_node->file_list);
@@ -7783,9 +7783,9 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, 
void __user *arg,
        }
 
        ref_node = alloc_fixed_file_ref_node(ctx);
-       if (IS_ERR(ref_node)) {
+       if (!ref_node) {
                io_sqe_files_unregister(ctx);
-               return PTR_ERR(ref_node);
+               return -ENOMEM;
        }
 
        io_sqe_files_set_node(file_data, ref_node);
@@ -7885,8 +7885,8 @@ static int __io_sqe_files_update(struct io_ring_ctx *ctx,
                return -EINVAL;
 
        ref_node = alloc_fixed_file_ref_node(ctx);
-       if (IS_ERR(ref_node))
-               return PTR_ERR(ref_node);
+       if (!ref_node)
+               return -ENOMEM;
 
        done = 0;
        fds = u64_to_user_ptr(up->fds);

(not even compile tested)

Re: [PATCH] io_uring: fix an IS_ERR() vs NULL check

[Dan Carpenter]

Jens just applied my patch right before you sent this.  I don't have
strong feeling either way about this.  I guess I sort of agree with
you.  If Jens can drop my patch then it should be pretty trivial for
you to add a commit message to your patch and give me a Reported-by
tag?

regards,
dan carpenter

Re: [PATCH] io_uring: fix an IS_ERR() vs NULL check

[Jens Axboe]

On 1/6/21 7:56 AM, Dan Carpenter wrote:
> Jens just applied my patch right before you sent this.  I don't have
> strong feeling either way about this.  I guess I sort of agree with
> you.  If Jens can drop my patch then it should be pretty trivial for
> you to add a commit message to your patch and give me a Reported-by
> tag?

I can just drop it, don't feel too strongly but would tend to agree
that we might as well just make it NULL/pointer as it's a single
error value. Willy, are you sending a patch?

-- 
Jens Axboe

Re: [PATCH] io_uring: fix an IS_ERR() vs NULL check

[Jens Axboe]

On 1/6/21 2:26 AM, Dan Carpenter wrote:
> The alloc_fixed_file_ref_node() function never returns NULL, it returns
> error pointers on error.

Applied, thanks.

-- 
Jens Axboe