Re: [PATCH 5/6] io_uring: drop confusion between cleanup flags

[Kanchan Joshi <joshi.k@samsung.com>]

[-- Attachment #1: Type: text/plain, Size: 1120 bytes --]

On Tue, May 24, 2022 at 03:37:26PM -0600, Jens Axboe wrote:
>If the opcode only stores data that needs to be kfree'ed in
>req->async_data, then it doesn't need special handling in
>our cleanup handler.
>
>This has the added bonus of removing knowledge of those kinds of
>special async_data to the io_uring core.
>
>Signed-off-by: Jens Axboe <axboe@kernel.dk>
>---
> fs/io_uring.c | 18 ------------------
> 1 file changed, 18 deletions(-)
>
>diff --git a/fs/io_uring.c b/fs/io_uring.c
>index 408265a03563..8188c47956ad 100644
>--- a/fs/io_uring.c
>+++ b/fs/io_uring.c
>@@ -8229,24 +8229,6 @@ static void io_clean_op(struct io_kiocb *req)
>
> 	if (req->flags & REQ_F_NEED_CLEANUP) {
> 		switch (req->opcode) {
>-		case IORING_OP_READV:
>-		case IORING_OP_READ_FIXED:
>-		case IORING_OP_READ:
>-		case IORING_OP_WRITEV:
>-		case IORING_OP_WRITE_FIXED:
>-		case IORING_OP_WRITE: {
>-			struct io_async_rw *io = req->async_data;
>-
>-			kfree(io->free_iovec);

Removing this kfree may cause a leak.
For READV/WRITEV atleast, io->free_iovec will hold the address of
allocated iovec array if input was larger than UIO_FASTIOV.

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]