diff mbox series

[5.19,2/6] io_uring: openclose: fix bug of closing wrong fixed file

Message ID 20220611122224.941800-2-hao.xu@linux.dev (mailing list archive)
State New
Headers show
Series [for-5.20,1/6] io_uring: poll: remove unnecessary req->ref set | expand

Commit Message

Hao Xu June 11, 2022, 12:22 p.m. UTC 
From: Hao Xu <howeyxu@tencent.com>

Don't update ret until fixed file is closed, otherwise the file slot
becomes the error code.

Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
Signed-off-by: Hao Xu <howeyxu@tencent.com>
---
 io_uring/rsrc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Pavel Begunkov June 11, 2022, 1:13 p.m. UTC | #1 
On 6/11/22 13:22, Hao Xu wrote:
> From: Hao Xu <howeyxu@tencent.com>
> 
> Don't update ret until fixed file is closed, otherwise the file slot
> becomes the error code.
> 
> Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
> Signed-off-by: Hao Xu <howeyxu@tencent.com>
> ---
>   io_uring/rsrc.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c

Something strange is going on here, io_uring/rsrc.c was only queued for
5.20, but it's marked 5.19, weird.


> index d78e7f2ea91f..cf8c85d1fb59 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -705,8 +705,8 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
>   		if (ret < 0)
>   			break;
>   		if (copy_to_user(&fds[done], &ret, sizeof(ret))) {
> -			ret = -EFAULT;
>   			__io_close_fixed(req, issue_flags, ret);
> +			ret = -EFAULT;
>   			break;
>   		}
>   	}
Pavel Begunkov June 12, 2022, 5:47 p.m. UTC | #2 
On 6/11/22 13:22, Hao Xu wrote:
> From: Hao Xu <howeyxu@tencent.com>
> 
> Don't update ret until fixed file is closed, otherwise the file slot
> becomes the error code.

I rebased and queued this and 6/6, will send them out together
later, thanks

https://github.com/isilence/linux/tree/io_uring/io_uring-5.19

> 
> Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
> Signed-off-by: Hao Xu <howeyxu@tencent.com>
> ---
>   io_uring/rsrc.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
> index d78e7f2ea91f..cf8c85d1fb59 100644
> --- a/io_uring/rsrc.c
> +++ b/io_uring/rsrc.c
> @@ -705,8 +705,8 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
>   		if (ret < 0)
>   			break;
>   		if (copy_to_user(&fds[done], &ret, sizeof(ret))) {
> -			ret = -EFAULT;
>   			__io_close_fixed(req, issue_flags, ret);
> +			ret = -EFAULT;
>   			break;
>   		}
>   	}
Hao Xu June 13, 2022, 3:45 a.m. UTC | #3 
On 6/13/22 01:47, Pavel Begunkov wrote:
> On 6/11/22 13:22, Hao Xu wrote:
>> From: Hao Xu <howeyxu@tencent.com>
>>
>> Don't update ret until fixed file is closed, otherwise the file slot
>> becomes the error code.
> 
> I rebased and queued this and 6/6, will send them out together
> later, thanks
> 
> https://github.com/isilence/linux/tree/io_uring/io_uring-5.19
> 

Thanks for rebasing it, was busy with something yesterday.

Thanks,
Hao
diff mbox series

Patch

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index d78e7f2ea91f..cf8c85d1fb59 100644
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -705,8 +705,8 @@  static int io_files_update_with_index_alloc(struct io_kiocb *req,
 		if (ret < 0)
 			break;
 		if (copy_to_user(&fds[done], &ret, sizeof(ret))) {
-			ret = -EFAULT;
 			__io_close_fixed(req, issue_flags, ret);
+			ret = -EFAULT;
 			break;
 		}
 	}