diff options
| author | Jens Axboe <axboe@kernel.dk> | 2021-07-22 17:08:07 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-28 14:37:39 +0200 |
| commit | a6ead78130ad6b3eadaaa5811be1ddaf1f6ec405 (patch) | |
| tree | d120f0614e592ead156f54a0a593d2ec8d876728 | |
| parent | 81cebadedc37c7b961382e90eca487d2c7bf75f7 (diff) | |
| download | linux-a6ead78130ad6b3eadaaa5811be1ddaf1f6ec405.tar.gz linux-a6ead78130ad6b3eadaaa5811be1ddaf1f6ec405.tar.bz2 linux-a6ead78130ad6b3eadaaa5811be1ddaf1f6ec405.zip | |
io_uring: fix early fdput() of file
commit 0cc936f74bcacb039b7533aeac0a887dfc896bf6 upstream.
A previous commit shuffled some code around, and inadvertently used
struct file after fdput() had been called on it. As we can't touch
the file post fdput() dropping our reference, move the fdput() to
after that has been done.
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/io-uring/YPnqM0fY3nM5RdRI@zeniv-ca.linux.org.uk/
Fixes: f2a48dd09b8e ("io_uring: refactor io_sq_offload_create()")
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/io_uring.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 437c9f602b7d..df4288776815 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7953,9 +7953,11 @@ static int io_sq_offload_create(struct io_ring_ctx *ctx, f = fdget(p->wq_fd); if (!f.file) return -ENXIO; - fdput(f); - if (f.file->f_op != &io_uring_fops) + if (f.file->f_op != &io_uring_fops) { + fdput(f); return -EINVAL; + } + fdput(f); } if (ctx->flags & IORING_SETUP_SQPOLL) { struct task_struct *tsk; |