diff options
| author | Jens Axboe <axboe@kernel.dk> | 2024-10-16 07:09:25 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2024-10-16 07:09:25 -0600 |
| commit | 858e686a30d7bffba3f3527add4f78766a4389d0 (patch) | |
| tree | 08c6e8b7ea8fe3233119a3adc4037e364be23a9b /io_uring/rsrc.c | |
| parent | 28aabffae6be54284869a91cd8bccd3720041129 (diff) | |
| download | linux-858e686a30d7bffba3f3527add4f78766a4389d0.tar.gz linux-858e686a30d7bffba3f3527add4f78766a4389d0.tar.bz2 linux-858e686a30d7bffba3f3527add4f78766a4389d0.zip | |
io_uring/rsrc: ignore dummy_ubuf for buffer cloning
For placeholder buffers, &dummy_ubuf is assigned which is a static
value. When buffers are attempted cloned, don't attempt to grab a
reference to it, as we both don't need it and it'll actively fail as
dummy_ubuf doesn't have a valid reference count setup.
Link: https://lore.kernel.org/io-uring/Zw8dkUzsxQ5LgAJL@ly-workstation/
Reported-by: Lai, Yi <yi1.lai@linux.intel.com>
Fixes: 7cc2a6eadcd7 ("io_uring: add IORING_REGISTER_COPY_BUFFERS method")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/rsrc.c')
| -rw-r--r-- | io_uring/rsrc.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c index 33a3d156a85b..6f3b6de230bd 100644 --- a/io_uring/rsrc.c +++ b/io_uring/rsrc.c @@ -1176,7 +1176,8 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx for (i = 0; i < nbufs; i++) { struct io_mapped_ubuf *src = src_ctx->user_bufs[i]; - refcount_inc(&src->refs); + if (src != &dummy_ubuf) + refcount_inc(&src->refs); user_bufs[i] = src; } |