Kernel/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2025-01-16 02:14:58 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

io_uring: fix corner case forgetting to vunmap

Browse Source 
io_pages_unmap() is a bit tricky in trying to figure whether the pages
were previously vmap'ed or not. In particular If there is juts one page
it belives there is no need to vunmap. Paired io_pages_map(), however,
could've failed io_mem_alloc_compound() and attempted to
io_mem_alloc_single(), which does vmap, and that leads to unpaired vmap.

The solution is to fail if io_mem_alloc_compound() can't allocate a
single page. That's the easiest way to deal with it, and those two
functions are getting removed soon, so no need to overcomplicate it.

Cc: stable@vger.kernel.org
Fixes: 3ab1db3c6039e ("io_uring: get rid of remap_pfn_range() for mapping rings/sqes")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/477e75a3907a2fe83249e49c0a92cd480b2c60e0.1732569842.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2024-11-25 23:10:31 +00:00 committed by Jens Axboe
parent 49c5c63d48
commit 43eef70e7e
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
io_uring/memmap.c
View File

@ -73,6 +73,8 @@ void *io_pages_map(struct page ***out_pages, unsigned short *npages,
ret = io_mem_alloc_compound(pages, nr_pages, size, gfp); ret = io_mem_alloc_compound(pages, nr_pages, size, gfp);
if (!IS_ERR(ret)) if (!IS_ERR(ret))
goto done; goto done;
if (nr_pages == 1)
goto fail;
ret = io_mem_alloc_single(pages, nr_pages, size, gfp); ret = io_mem_alloc_single(pages, nr_pages, size, gfp);
if (!IS_ERR(ret)) { if (!IS_ERR(ret)) {
@ -81,7 +83,7 @@ done:
*npages = nr_pages; *npages = nr_pages;
return ret; return ret;
} }
fail:
kvfree(pages); kvfree(pages);
*out_pages = NULL; *out_pages = NULL;
*npages = 0; *npages = 0;