[PATCH] io_uring/kbuf: ensure ring ctx is held locked over io_put_kbuf()

[Jens Axboe <axboe@kernel.dk>]

The issue_flags will tell us if this is needed or not, however a
previous commit was a bit too eager with the cleanups and removed the
required locking in case IO_URING_F_UNLOCKED is set in the issue_flags.

Cc: stable@vger.kernel.org
Fixes: e150e70fce42 ("io_uring/kbuf: open code __io_put_kbuf()")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/io_uring/kbuf.h b/io_uring/kbuf.h
index 723d0361898e..7f17e87d8617 100644
--- a/io_uring/kbuf.h
+++ b/io_uring/kbuf.h
@@ -4,6 +4,7 @@
 
 #include <uapi/linux/io_uring.h>
 #include <linux/io_uring_types.h>
+#include "io_uring.h"
 
 enum {
 	/* ring mapped provided buffers */
@@ -124,9 +125,14 @@ static inline bool io_kbuf_recycle(struct io_kiocb *req, unsigned issue_flags)
 static inline unsigned int io_put_kbuf(struct io_kiocb *req, int len,
 				       unsigned issue_flags)
 {
+	int ret;
+
 	if (!(req->flags & (REQ_F_BUFFER_RING | REQ_F_BUFFER_SELECTED)))
 		return 0;
-	return __io_put_kbufs(req, len, 1);
+	io_ring_submit_lock(req->ctx, issue_flags);
+	ret = __io_put_kbufs(req, len, 1);
+	io_ring_submit_unlock(req->ctx, issue_flags);
+	return ret;
 }
 
 static inline unsigned int io_put_kbufs(struct io_kiocb *req, int len,

-- 
Jens Axboe