diff options
| author | Jaeyeong Lee <iostreampy@proton.me> | 2026-07-12 14:27:12 +0000 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-07-14 12:14:59 -0600 |
| commit | f1596ba3e6b390aa0fef8466afce44efecf39d8d (patch) | |
| tree | 20d89b459f7f4f689205c601870642c54a227e29 /io_uring | |
| parent | f3176c8ac4217c88fe1147ab084c47092921ffc4 (diff) | |
| download | linux-f1596ba3e6b390aa0fef8466afce44efecf39d8d.tar.gz linux-f1596ba3e6b390aa0fef8466afce44efecf39d8d.tar.bz2 linux-f1596ba3e6b390aa0fef8466afce44efecf39d8d.zip | |
io_uring/kbuf: free the replaced iovec after a successful grow
The provided-buffer validation fix deferred freeing a cached iovec
until validation completed. However, the deferred free uses arg->iovs.
After a grow, that points to the newly allocated array. Without a grow,
it points to the cached array that remains in use.
This leaves the caller with a dangling iovec in both cases and can
result in repeated frees. Only free org_iovs when arg->iovs actually
replaced it.
Fixes: cd053d788c3f ("io_uring: fix dangling iovec after provided-buffer bundle grow failure")
Assisted-by: Codex:gpt-5.3-codex-spark
Signed-off-by: Jaeyeong Lee <iostreampy@proton.me>
Link: https://patch.msgid.link/20260712142612.188695595-iostreampy@proton.me
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/kbuf.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index b6b969b55e12..de0129bceaba 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -328,8 +328,8 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, buf = io_ring_head_to_buf(br, ++head, bl->mask); } while (--nr_iovs); - if (arg->mode & KBUF_MODE_FREE) - kfree(arg->iovs); + if (arg->iovs != org_iovs && (arg->mode & KBUF_MODE_FREE)) + kfree(org_iovs); if (head == tail) req->flags |= REQ_F_BL_EMPTY; |