Re: [PATCH] io_uring: Fix leaking double_put()

[Pavel Begunkov <asml.silence@gmail.com>]

[-- Attachment #1.1: Type: text/plain, Size: 745 bytes --]

On 12/11/2019 18:02, Jens Axboe wrote:
> On 11/12/19 12:17 AM, Pavel Begunkov wrote:
>> io_double_put_req() may be called for a request with a link (see
>> io_req_defer(req)), and so can leak it in case of an error, as
>> __io_free_req() doesn't handle links.
>>
>> Fixes: 78e19bbef38362ceb ("io_uring: pass in io_kiocb to fill/add CQ
>> handlers")
> 
> This blows up the 'link' test from the liburing regression suite:

> -			io_double_put_req(link);
> +			if (refcount_sub_and_test(2, &req->refs))
> +				__io_free_req(req);

My bad, it frees @req instead of @link. Sorry for the trouble.

It wouldn't apply properly anyway, as there is new commit using
io_double_put_req(). I'll resend it later.


-- 
Pavel Begunkov


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]