From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E91ACCA473 for ; Tue, 21 Jun 2022 23:01:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353965AbiFUXBQ (ORCPT ); Tue, 21 Jun 2022 19:01:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53514 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229575AbiFUXBP (ORCPT ); Tue, 21 Jun 2022 19:01:15 -0400 Received: from mail-wr1-x42e.google.com (mail-wr1-x42e.google.com [IPv6:2a00:1450:4864:20::42e]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54C942E6B8 for ; Tue, 21 Jun 2022 16:01:13 -0700 (PDT) Received: by mail-wr1-x42e.google.com with SMTP id w17so20891800wrg.7 for ; Tue, 21 Jun 2022 16:01:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=nn2a2KKHnEW+tenzPHxmOsTwnVub8z9r9JtzehG3s78=; b=LmEWgMlgzvM5CoW3RtNLGBNeDDtQdWQdoKE2VE4MWv5AJtAJj3k/NQ1OM38l5a2u+f b8PYQDPssWrZjV86OtGG59nOeQ5H1hRE2JevwpUX4auIIGgMDrGc1No289YeHtnTboO+ ycIrlMwNKAxBMQasNFB8xO7+FBq+bPjW+opyTILAmaNcVbU0e9ohTbKZGljzHRBul5fJ yWTw9Rpr6etv6Zac0dQJ2EVQpb3K4cll3/XzuFh5Pplg+dg8f1DJ1dmeFGHQGKP5bLZP arsVgMy+Ku2JL8iXYJfqkDTJQMIbGN1zzOzjsnQUnXug6jEFpQmmV6psR1oHhByInw6u DlbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=nn2a2KKHnEW+tenzPHxmOsTwnVub8z9r9JtzehG3s78=; b=kuhF7Q0YnY5jYkqZTPOcnuLSbO/WPdZ6sJaJvxUdIeozKatLHNtqZ/NPDK0YoHF69T AaHJ1+QuWw4jdCPb0/3f042d9mPyKoAobGmxQYXuM+ceOPKhvnudqjF0q/eMLwaUp19V dl+HIjYLdbrmHD7n/cVggxmdnX430tcjuZazjK3ohPUcRtd5beTmeL3BfbswWMTSHFf4 5RukEW31EXo3evZ5TiOyiQbZ/ZBZq9ebmzyYkbdwawJrUqK1gdhiDnhbS7ta0QX0um9X n9a/OydHbjsqCxjh7EosCs84+N2m7ZikzU2t/756TMnNu0Z0sZbV1z6I9LAXk+JsgEV0 99+g== X-Gm-Message-State: AJIora9XsjWa5FFzM9piQzGBvq3l/x+Q5vtrhgtw+C9RARJVIrMHPQyU wQimpMEeIA1wy2Moz7HFNK2w7+J/Xmq+askQ X-Google-Smtp-Source: AGRyM1sYEHLf9fkLYZFWZCYQXyfSlQW6y8gudqQ06j9IBtoE5sLScSE1cVZfr6IMkYnajclOuwz3Mw== X-Received: by 2002:a5d:5234:0:b0:21b:829c:3058 with SMTP id i20-20020a5d5234000000b0021b829c3058mr286200wra.13.1655852471632; Tue, 21 Jun 2022 16:01:11 -0700 (PDT) Received: from 127.0.0.1localhost (188.28.125.106.threembb.co.uk. [188.28.125.106]) by smtp.gmail.com with ESMTPSA id q2-20020a05600000c200b0021b8ea5c7bdsm7630462wrx.42.2022.06.21.16.01.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 21 Jun 2022 16:01:11 -0700 (PDT) From: Pavel Begunkov To: io-uring@vger.kernel.org Cc: Jens Axboe , asml.silence@gmail.com Subject: [PATCH 5.19 3/3] io_uring: fix double poll leak on repolling Date: Wed, 22 Jun 2022 00:00:37 +0100 Message-Id: X-Mailer: git-send-email 2.36.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: io-uring@vger.kernel.org We have re-polling for partial IO, so a request can be polled twice. If it used two poll entries the first time then on the second io_arm_poll_handler() it will find the old apoll entry and NULL kmalloc()'ed second entry, i.e. apoll->double_poll, so leaking it. Fixes: 10c873334feba ("io_uring: allow re-poll if we made progress") Signed-off-by: Pavel Begunkov --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index cb719a53b8bd..5c95755619e2 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7208,6 +7208,7 @@ static int io_arm_poll_handler(struct io_kiocb *req, unsigned issue_flags) mask |= EPOLLEXCLUSIVE; if (req->flags & REQ_F_POLLED) { apoll = req->apoll; + kfree(apoll->double_poll); } else if (!(issue_flags & IO_URING_F_UNLOCKED) && !list_empty(&ctx->apoll_cache)) { apoll = list_first_entry(&ctx->apoll_cache, struct async_poll, -- 2.36.1