| Message ID | 20250319112401.22316-1-sidong.yang@furiosa.ai (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [1/1] btrfs: ioctl: don't free iov when -EAGAIN in uring encoded read | expand |
On Wed, Mar 19, 2025 at 11:24:01AM +0000, Sidong Yang wrote: > This patch fixes a bug on encoded_read. In btrfs_uring_encoded_read(), > btrfs_encoded_read could return -EAGAIN when receiving requests concurrently. > And data->iov goes to out_free and it freed and return -EAGAIN. io-uring > subsystem would call it again and it doesn't reset data. And data->iov > freed and iov_iter reference it. iov_iter would be used in > btrfs_uring_read_finished() and could be raise memory bug. > > Signed-off-by: Sidong Yang <sidong.yang@furiosa.ai> Thanks, added to for-next, with a bit updated changelog and added stable tag for 6.13.
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index c44e6ce6e5f5..b556db9e7cc4 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -4924,6 +4924,9 @@ static int btrfs_uring_encoded_read(struct io_uring_cmd *cmd, unsigned int issue ret = btrfs_encoded_read(&kiocb, &data->iter, &data->args, &cached_state, &disk_bytenr, &disk_io_size); + + if (ret == -EAGAIN) + goto out_acct; if (ret < 0 && ret != -EIOCBQUEUED) goto out_free;
This patch fixes a bug on encoded_read. In btrfs_uring_encoded_read(), btrfs_encoded_read could return -EAGAIN when receiving requests concurrently. And data->iov goes to out_free and it freed and return -EAGAIN. io-uring subsystem would call it again and it doesn't reset data. And data->iov freed and iov_iter reference it. iov_iter would be used in btrfs_uring_read_finished() and could be raise memory bug. Signed-off-by: Sidong Yang <sidong.yang@furiosa.ai> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+)