io_uring: Fix XArray usage in io_uring_add_task_file
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Fri, 9 Oct 2020 12:49:52 +0000 (13:49 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 1 Nov 2020 11:45:36 +0000 (12:45 +0100)
commitf7b24bee5e6ef939d8c312483cd4ea2648df81d0
tree38d8e73ee2e1e54e973eb19f3ddc72cc35dbde71
parentefce965a49f118521da9a0e60e7c3a91bdce4cd9
io_uring: Fix XArray usage in io_uring_add_task_file

commit 236434c3438c4da3dfbd6aeeab807577b85e951a upstream.

The xas_store() wasn't paired with an xas_nomem() loop, so if it couldn't
allocate memory using GFP_NOWAIT, it would leak the reference to the file
descriptor.  Also the node pointed to by the xas could be freed between
the call to xas_load() under the rcu_read_lock() and the acquisition of
the xa_lock.

It's easier to just use the normal xa_load/xa_store interface here.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[axboe: fix missing assign after alloc, cur_uring -> tctx rename]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
fs/io_uring.c