io_uring: Fix XArray usage in io_uring_add_task_file
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Fri, 9 Oct 2020 12:49:52 +0000 (13:49 +0100)
committerJens Axboe <axboe@kernel.dk>
Mon, 12 Oct 2020 20:59:33 +0000 (14:59 -0600)
commit057576b74842364ee5ab87d361f7dc42f96653b3
tree6f1e2c3884855d48fa54010d71b4c4c368b91314
parent282757c38c41e30a8dc0098eb8f6d879acf0553b
io_uring: Fix XArray usage in io_uring_add_task_file

commit 236434c3438c4da3dfbd6aeeab807577b85e951a upstream.

The xas_store() wasn't paired with an xas_nomem() loop, so if it couldn't
allocate memory using GFP_NOWAIT, it would leak the reference to the file
descriptor.  Also the node pointed to by the xas could be freed between
the call to xas_load() under the rcu_read_lock() and the acquisition of
the xa_lock.

It's easier to just use the normal xa_load/xa_store interface here.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[axboe: fix missing assign after alloc, cur_uring -> tctx rename]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c