io_uring/rsrc: clean up __io_sqe_buffers_update()

Inline offset variable, so we don't use it without subjecting it to
array_index_nospec() first.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/77936d9ed23755588810c5eafcea7e1c3b90e3cd.1681395792.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index bfa0b382c6c6a6e07f37c777797e3aac532d1281..38f0c9ce67a7794397aac7d8a72dd10aae2a054a 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -469,7 +469,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
 
        for (done = 0; done < nr_args; done++) {
                struct io_mapped_ubuf *imu;
-               int offset = up->offset + done;
                u64 tag = 0;
 
                err = io_copy_iov(ctx, &iov, iovs, done);
@@ -490,7 +489,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
                if (err)
                        break;
 
-               i = array_index_nospec(offset, ctx->nr_user_bufs);
+               i = array_index_nospec(up->offset + done, ctx->nr_user_bufs);
                if (ctx->user_bufs[i] != ctx->dummy_ubuf) {
                        err = io_queue_rsrc_removal(ctx->buf_data, i,
                                                    ctx->rsrc_node, ctx->user_bufs[i]);