From 91007f210464dadaa47ca4711901dfcc8ea98c2f Mon Sep 17 00:00:00 2001 From: Anuj Gupta Date: Thu, 11 Aug 2022 14:44:59 +0530 Subject: [PATCH] io_uring: fix error handling for io_uring_cmd Commit 1efbdb3a123b ("io_uring: handle completions in the core") moved the error handling from handler to core. But for io_uring_cmd handler we end up completing more than once (both in handler and in core) leading to use_after_free. Change io_uring_cmd handler to avoid calling io_uring_cmd_done in case of error. Fixes: 1efbdb3a123b ("io_uring: handle completions in the core") Signed-off-by: Anuj Gupta Signed-off-by: Kanchan Joshi Link: https://lore.kernel.org/r/20220811091459.6929-1-anuj20.g@samsung.com [axboe: fix ret vs req typo] Signed-off-by: Jens Axboe --- io_uring/uring_cmd.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/io_uring/uring_cmd.c b/io_uring/uring_cmd.c index 849d9708d612f..ee7036f2241fc 100644 --- a/io_uring/uring_cmd.c +++ b/io_uring/uring_cmd.c @@ -106,7 +106,9 @@ int io_uring_cmd(struct io_kiocb *req, unsigned int issue_flags) } if (ret != -EIOCBQUEUED) { - io_uring_cmd_done(ioucmd, ret, 0); + if (ret < 0) + req_set_fail(req); + io_req_set_res(req, ret, 0); return IOU_OK; } -- 2.39.5