summaryrefslogtreecommitdiffstats
path: root/io_uring/kbuf.c
diff options
context:
space:
mode:
authorWojciech Lukowicz <wlukowicz01@gmail.com>2023-04-01 20:50:39 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2023-04-13 16:55:31 +0200
commitac48787f58d1068f4e06d627c1135784d64b4c72 (patch)
tree54f1d884fa2251f56b8defc290b39d1e620b0616 /io_uring/kbuf.c
parentbd4081fa1cd9563d112155a5aa58fbba7bb4f647 (diff)
downloadlinux-stable-ac48787f58d1068f4e06d627c1135784d64b4c72.tar.gz
linux-stable-ac48787f58d1068f4e06d627c1135784d64b4c72.tar.bz2
linux-stable-ac48787f58d1068f4e06d627c1135784d64b4c72.zip
io_uring: fix memory leak when removing provided buffers
[ Upstream commit b4a72c0589fdea6259720375426179888969d6a2 ] When removing provided buffers, io_buffer structs are not being disposed of, leading to a memory leak. They can't be freed individually, because they are allocated in page-sized groups. They need to be added to some free list instead, such as io_buffers_cache. All callers already hold the lock protecting it, apart from when destroying buffers, so had to extend the lock there. Fixes: cc3cec8367cb ("io_uring: speedup provided buffer handling") Signed-off-by: Wojciech Lukowicz <wlukowicz01@gmail.com> Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'io_uring/kbuf.c')
-rw-r--r--io_uring/kbuf.c5
1 files changed, 4 insertions, 1 deletions
diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 9a9db1fcdc14..acc37e5a6d4e 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -228,11 +228,14 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
return i;
}
+ /* protects io_buffers_cache */
+ lockdep_assert_held(&ctx->uring_lock);
+
while (!list_empty(&bl->buf_list)) {
struct io_buffer *nxt;
nxt = list_first_entry(&bl->buf_list, struct io_buffer, list);
- list_del(&nxt->list);
+ list_move(&nxt->list, &ctx->io_buffers_cache);
if (++i == nbufs)
return i;
cond_resched();