[PATCH] io_uring: initialize io_buffer_list head when shared ring is unregistered

[PATCH] io_uring: initialize io_buffer_list head when shared ring is unregistered

[Jens Axboe]

We use ->buf_pages != 0 to tell if this is a shared buffer ring or a
classic provided buffer group. If we unregister the shared ring and
then attempt to use it, buf_pages is zero yet the classic list head
isn't properly initialized. This causes io_buffer_select() to think
that we have classic buffers available, but then we crash when we try
and get one from the list.

Just initialize the list if we unregister a shared buffer ring, leaving
it in a sane state for either re-registration or for attempting to use
it.

Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/fs/io_uring.c b/fs/io_uring.c
index a210a2c0429d..23d68f8dfc66 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -12200,6 +12200,9 @@ static int io_unregister_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
 	if (bl->bgid >= BGID_ARRAY) {
 		xa_erase(&ctx->io_bl_xa, bl->bgid);
 		kfree(bl);
+	} else {
+		/* make sure it's seen as empty */
+		INIT_LIST_HEAD(&bl->buf_list);
 	}
 	return 0;
 }

-- 
Jens Axboe

[PATCH v2] io_uring: initialize io_buffer_list head when shared ring is unregistered

[Jens Axboe]

We use ->buf_pages != 0 to tell if this is a shared buffer ring or a
classic provided buffer group. If we unregister the shared ring and
then attempt to use it, buf_pages is zero yet the classic list head
isn't properly initialized. This causes io_buffer_select() to think
that we have classic buffers available, but then we crash when we try
and get one from the list.

Just initialize the list if we unregister a shared buffer ring, leaving
it in a sane state for either re-registration or for attempting to use
it.

Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

v2: do it in the place where we clear buf_nr_pages, that's safer and
    cleaner.

diff --git a/fs/io_uring.c b/fs/io_uring.c
index a210a2c0429d..24d56b2a0637 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -4969,6 +4969,8 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
 		kvfree(bl->buf_pages);
 		bl->buf_pages = NULL;
 		bl->buf_nr_pages = 0;
+		/* make sure it's seen as empty */
+		INIT_LIST_HEAD(&bl->buf_list);
 		return i;
 	}
 

-- 
Jens Axboe