mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-07-21 23:57:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

io_uring/kbuf: free the replaced iovec after a successful grow

Browse Source 
The provided-buffer validation fix deferred freeing a cached iovec
until validation completed. However, the deferred free uses arg->iovs.
After a grow, that points to the newly allocated array. Without a grow,
it points to the cached array that remains in use.

This leaves the caller with a dangling iovec in both cases and can
result in repeated frees. Only free org_iovs when arg->iovs actually
replaced it.

Fixes: cd053d788c ("io_uring: fix dangling iovec after provided-buffer bundle grow failure")
Assisted-by: Codex:gpt-5.3-codex-spark
Signed-off-by: Jaeyeong Lee <iostreampy@proton.me>
Link: https://patch.msgid.link/20260712142612.188695595-iostreampy@proton.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Jaeyeong Lee
2026-07-12 14:27:12 +00:00
committed by Jens Axboe
parent f3176c8ac4
commit f1596ba3e6
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
io_uring/kbuf.c
View File

@@ -328,8 +328,8 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
buf = io_ring_head_to_buf(br, ++head, bl->mask);
} while (--nr_iovs);
if (arg->mode & KBUF_MODE_FREE)
kfree(arg->iovs);
if (arg->iovs != org_iovs && (arg->mode & KBUF_MODE_FREE))
kfree(org_iovs);
if (head == tail)
req->flags |= REQ_F_BL_EMPTY;