Re: [PATCH] io_uring: fix error handling for io_uring_cmd

[Jens Axboe <axboe@kernel.dk>]

On 8/11/22 9:38 AM, Jens Axboe wrote:
> On Thu, 11 Aug 2022 14:44:59 +0530, Anuj Gupta wrote:
>> Commit 97b388d70b53 ("io_uring: handle completions in the core") moved the
>> error handling from handler to core. But for io_uring_cmd handler we end
>> up completing more than once (both in handler and in core) leading to
>> use_after_free.
>> Change io_uring_cmd handler to avoid calling io_uring_cmd_done in case
>> of error.
>>
>> [...]
> 
> Applied, thanks!
> 
> [1/1] io_uring: fix error handling for io_uring_cmd
>       commit: f1bb0fd63c374e1410ff05fb434aa78e1ce09ae4

Ehm, did you compile this:

> io_uring/uring_cmd.c: In function ?io_uring_cmd?:
io_uring/uring_cmd.c:113:38: warning: passing argument 1 of ?req_set_fail? makes pointer from integer without a cast [-Wint-conversion]
  113 |                         req_set_fail(ret);
      |                                      ^~~
      |                                      |
      |                                      int
In file included from io_uring/uring_cmd.c:9:
io_uring/io_uring.h:144:50: note: expected ?struct io_kiocb *? but argument is of type ?int?
  144 | static inline void req_set_fail(struct io_kiocb *req)
      |                                 ~~~~~~~~~~~~~~~~~^~~

s/ret/req obviously.

-- 
Jens Axboe