From 1d0dbbfa282d9be57792e3b5827dc57b010181ee Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Wed, 18 May 2022 14:36:18 -0600 Subject: [PATCH] io_uring: initialize io_buffer_list head when shared ring is unregistered We use ->buf_pages != 0 to tell if this is a shared buffer ring or a classic provided buffer group. If we unregister the shared ring and then attempt to use it, buf_pages is zero yet the classic list head isn't properly initialized. This causes io_buffer_select() to think that we have classic buffers available, but then we crash when we try and get one from the list. Just initialize the list if we unregister a shared buffer ring, leaving it in a sane state for either re-registration or for attempting to use it. And do the same for the initial setup from the classic path. Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Jens Axboe --- fs/io_uring.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index a210a2c0429d..8fc3dd49bc04 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4969,6 +4969,8 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, kvfree(bl->buf_pages); bl->buf_pages = NULL; bl->buf_nr_pages = 0; + /* make sure it's seen as empty */ + INIT_LIST_HEAD(&bl->buf_list); return i; } @@ -5156,6 +5158,7 @@ static int io_provide_buffers(struct io_kiocb *req, unsigned int issue_flags) ret = -ENOMEM; goto err; } + INIT_LIST_HEAD(&bl->buf_list); ret = io_buffer_add_list(ctx, bl, p->bgid); if (ret) { kfree(bl);