diff options
| author |   Pavel Begunkov <asml.silence@gmail.com> | 2021-04-01 12:18:48 +0100 |
|---|---|---|
| committer |   Jens Axboe <axboe@kernel.dk> | 2021-04-01 09:31:21 -0600 |
| commit | 07204f21577a1d882f0259590c3553fe6a476381 (patch) | |
| tree | a581bb61e2722e70687801c9c9ec7c907ffaa24c /fs/io_uring.c | |
| parent | io_uring/io-wq: protect against sprintf overflow (diff) | |
| download | linux-dev-07204f21577a1d882f0259590c3553fe6a476381.tar.xz linux-dev-07204f21577a1d882f0259590c3553fe6a476381.zip | |
io_uring: fix EIOCBQUEUED iter revert
iov_iter_revert() is done in completion handlers that happensf before
read/write returns -EIOCBQUEUED, no need to repeat reverting afterwards.
Moreover, even though it may appear being just a no-op, it's actually
races with 1) user forging a new iovec of a different size 2) reissue,
that is done via io-wq continues completely asynchronously.
Fixes: 3e6a0d3c7571c ("io_uring: fix -EAGAIN retry with IOPOLL")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to '')
| -rw-r--r-- | fs/io_uring.c | 4 |
1 files changed, 0 insertions, 4 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 4a6701b5065e..717942474fa9 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3284,8 +3284,6 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags) ret = io_iter_do_read(req, iter); if (ret == -EIOCBQUEUED) { - if (req->async_data) - iov_iter_revert(iter, io_size - iov_iter_count(iter)); goto out_free; } else if (ret == -EAGAIN) { /* IOPOLL retry should happen for io-wq threads */ @@ -3418,8 +3416,6 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags) /* no retry on NONBLOCK nor RWF_NOWAIT */ if (ret2 == -EAGAIN && (req->flags & REQ_F_NOWAIT)) goto done; - if (ret2 == -EIOCBQUEUED && req->async_data) - iov_iter_revert(iter, io_size - iov_iter_count(iter)); if (!force_nonblock || ret2 != -EAGAIN) { /* IOPOLL retry should happen for io-wq threads */ if ((req->ctx->flags & IORING_SETUP_IOPOLL) && ret2 == -EAGAIN) |