io_uring: Fix XArray usage in io_uring_add_task_file
authorMatthew Wilcox (Oracle) <willy@infradead.org>
Fri, 9 Oct 2020 12:49:52 +0000 (13:49 +0100)
committerJens Axboe <axboe@kernel.dk>
Mon, 12 Oct 2020 21:03:11 +0000 (15:03 -0600)
commitb267238d1bf7c09f6f9c23b6b7547ab1e5b11cfc
tree34f8008c72970c6483f73d86c57a945821299bf8
parent68798e6df7ae32afddc3a3a5971620b92ff192c9
io_uring: Fix XArray usage in io_uring_add_task_file

commit 236434c3438c4da3dfbd6aeeab807577b85e951a upstream.

The xas_store() wasn't paired with an xas_nomem() loop, so if it couldn't
allocate memory using GFP_NOWAIT, it would leak the reference to the file
descriptor.  Also the node pointed to by the xas could be freed between
the call to xas_load() under the rcu_read_lock() and the acquisition of
the xa_lock.

It's easier to just use the normal xa_load/xa_store interface here.

Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
[axboe: fix missing assign after alloc, cur_uring -> tctx rename]
Signed-off-by: Jens Axboe <axboe@kernel.dk>
fs/io_uring.c