Re: IORING_OP_CLOSE fails on fd opened with O_PATH

Jann Horn
2020-06-02T19:16:48Z

On Tue, Jun 2, 2020 at 8:42 PM Jens Axboe <axboe@kernel.dk> wrote:
> On 6/2/20 12:22 PM, Jann Horn wrote:
> > On Sun, May 31, 2020 at 10:19 PM Jens Axboe <axboe@kernel.dk> wrote:
> >> We just need this ported to stable once it goes into 5.8-rc:
> >>
> >> https://git.kernel.dk/cgit/linux-block/commit/?h=for-5.8/io_uring&id=904fbcb115c85090484dfdffaf7f461d96fe8e53
> >
> > How does that work? Who guarantees that the close operation can't drop
> > the refcount of the uring instance to zero before reaching the fdput()
> > in io_uring_enter?
>
> Because io_uring_enter() holds a reference to it as well?

Which reference do you mean? fdget() doesn't take a reference if the
calling process is single-threaded, you'd have to use fget() for that.