From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f176.google.com (mail-pf1-f176.google.com [209.85.210.176]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EECE6432BE8 for ; Mon, 6 Jul 2026 16:56:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.176 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783356980; cv=none; b=kxuouFbx+2kGmZEJub+UZnhQ7Y7eMsGXb1Lz2qIzelheXZkCti4+gUQmVOkQbU+7yd9Q2mWZrDelp/1mvyAE/qunykWYeG+2+5HLXESm7luJMQ7HcBewzL+m+XFJOlZMhsIoqadqeoIcfSWTdf+OLFASTCZ3dQdq04zijTb47K4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783356980; c=relaxed/simple; bh=pj9Qhwd3v14MK5Ez1XXQPAeON02TWJz1KkvqtxZoCBc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OLV61/JIVmX0hlGZiiYW+YsDP1bKLZqGpvB7b71egrHhrugtkhuxFhQQkZrBWrYg/jNvomFQgK61Ih59V228TnI57LEr64ArNxdgXiqUUYihvwJFQuHolXwfzj+PiL7l6ixgwfh2FmIzxIYvQ/R0GYyRwXTB8JepxvVL5VqWbnI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ZTNj7ojh; arc=none smtp.client-ip=209.85.210.176 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ZTNj7ojh" Received: by mail-pf1-f176.google.com with SMTP id d2e1a72fcca58-8475eca3a66so4810320b3a.2 for ; Mon, 06 Jul 2026 09:56:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783356978; x=1783961778; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=KJqSbEEwGKy2Cb+HZgBKJBUYQo8t2/zQH8XFgmSxLqU=; b=ZTNj7ojhh2ymUb/HFhuKwLV8Ln2P+mmVjKJGsq17jVwB8/yVsqaoY+4g6P4RPjY+pV xpxptZjt7Yli9tM9pL2ordvJqD5yylz/7WdGMSJ5Ze6oj6v5WP1tAeOUVYp9RgUrl+Id C5rZekhj5JY2krqEEJfL5Lf85ZjiYeVCMaLiPZzlqIEtg0DFmrKX1H4hNtbkEjDEUEt+ OJ0czFGv/7p41de6RgiFWR/wF8wY3t8mPgduIcrmkuUbsklIRFjYeVDgQxsRVMNdDStz Q00vs9xG1jugYaDnP/8ydPnN0m2T3LbHGEeGES5x7p2zrZuOuWQw1Xeot2isFKyUp4TP 6IMA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783356978; x=1783961778; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=KJqSbEEwGKy2Cb+HZgBKJBUYQo8t2/zQH8XFgmSxLqU=; b=Fryp01FZkamNTIQTOTZD6qvW7QIj4vWzKr3w4oBtzff2gOnluChSQTyRT+ipTZJ2h5 H3cnzpNBeXQfVgM1V4I1xGRZJM3cxlXRXcUqJrJYJ1WXuyG8A/LUiQpNq66JcAVURsfg 1LG3d7Sz0RWeNRoPxAqLydDvJZ+HiWc87T8xMD8AjvAtfc6L0IAlnQgc7THHXtDqTIcd bX+zUFVwTCh9csxvQqkrXlQmCTXM2h4WNd0Al73NR3fdBkQbC9yLZyLqIopJrnA9dY1I aeLuxuu3yIcvM7a39pcwhw6OVsjX3EKBQ5h21bQwANTiw0ckWnrB3iAYsrBfZQlvzyQG ZdWg== X-Gm-Message-State: AOJu0YxkzKvKBjv3C5NhcA4+Vf8gUY5o8MhUQI4prinwUIuFPhNd/miR QHGX1bd9gVyU5+1E9ejQxwM9ptbsHOqrz6Omq56ijALXrsQSWYPPHczp X-Gm-Gg: AfdE7cksvw7YJZae0cwdDHgxKLgTxno4hYdqR/Gshn89obM62FCSE7B4hreBPTDSLmb dgBpFWknvdtIs0uylF1MRvN/AkNKzSOvu8/OSB/b02qQDIiedz504S9qcnfq0l6+jS44tyXn5s1 e+Q46dKCKvA2zKqaaYEiNzwxZDQjW+hsggSlaa0Gw76ozJug39be6/KeQomzJIf8QiEpZV4hH0k Ub5pT9/CSYciPr1tk7QMkVjOAX1DfQ1hCvw/RKpHcbLlXHnpve1TeX0gXn5kir5fLBNgirStDbW 6IXImGOARV12HaTp6oYTjc7SOm2F1vcjAMZR/KDpiEFUilKPtr3GGctQWwHb5o1tH1KxZxit9wJ kdiMUA49vFgI+DnQjbfP9LPV5k/g5pNNVK+ctICHudebZ4vHr/Vm4yvS7A/O/vGAA58fNF0dz86 REWICoIZBcjmVPkX4QeUfjFX/eaqhNZECWu5Qs0UQ= X-Received: by 2002:a05:6a00:e83:b0:847:77e7:6f64 with SMTP id d2e1a72fcca58-84826c976c4mr1541466b3a.20.1783356978171; Mon, 06 Jul 2026 09:56:18 -0700 (PDT) Received: from naup-virtual-machine ([140.113.139.102]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-847f6b95c89sm4303497b3a.15.2026.07.06.09.56.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 06 Jul 2026 09:56:17 -0700 (PDT) Date: Tue, 7 Jul 2026 00:56:14 +0800 From: Hao-Yu Yang To: Jens Axboe Cc: linux-kernel@vger.kernel.org, io-uring@vger.kernel.org Subject: Re: [PATCH v1] io_uring: fix dangling iovec after provided-buffer bundle grow failure Message-ID: References: <20260705234534.768138-1-naup96721@gmail.com> <717fd2f3-6493-4dc5-ba83-c8d2af278639@kernel.dk> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <717fd2f3-6493-4dc5-ba83-c8d2af278639@kernel.dk> Oh, this patch looks more clear. The original iovec is freed only after access_ok is verified, and the updated iovec for kmsg is returned to the upper layer. In the error path, the original iovec object is not freed, and the upper layer's iovec is not updated along that path. If there are no other issues, I will send the second version of the patch when I wake up. Thanks for your review. On Mon, Jul 06, 2026 at 10:19:10AM -0600, Jens Axboe wrote: > On 7/5/26 5:45 PM, Hao-Yu Yang wrote: > > diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c > > index 3cd29477fff2..4055173e0c48 100644 > > --- a/io_uring/kbuf.c > > +++ b/io_uring/kbuf.c > > @@ -256,6 +256,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > > struct io_uring_buf_ring *br = bl->buf_ring; > > struct iovec *org_iovs = arg->iovs; > > struct iovec *iov = arg->iovs; > > + struct iovec *old = NULL; > > int nr_iovs = arg->nr_iovs; > > __u16 nr_avail, tail, head; > > struct io_uring_buf *buf; > > @@ -288,7 +289,7 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > > if (unlikely(!iov)) > > return -ENOMEM; > > if (arg->mode & KBUF_MODE_FREE) > > - kfree(arg->iovs); > > + old = arg->iovs; > > arg->iovs = iov; > > nr_iovs = nr_avail; > > } else if (nr_avail < nr_iovs) { > > @@ -318,6 +319,8 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > > if (unlikely(!access_ok(iov->iov_base, len))) { > > if (arg->iovs != org_iovs) > > kfree(arg->iovs); > > + /* hand the still-live cached vec back to the owner */ > > + arg->iovs = org_iovs; > > return -EFAULT; > > } > > iov++; > > @@ -330,6 +333,8 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > > buf = io_ring_head_to_buf(br, ++head, bl->mask); > > } while (--nr_iovs); > > > > + kfree(old); > > + > > if (head == tail) > > req->flags |= REQ_F_BL_EMPTY; > > Can't we just do the below, that seems a lot simpler? > > diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c > index 3cd29477fff2..3bb24d20c890 100644 > --- a/io_uring/kbuf.c > +++ b/io_uring/kbuf.c > @@ -287,8 +287,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > iov = kmalloc_objs(struct iovec, nr_avail); > if (unlikely(!iov)) > return -ENOMEM; > - if (arg->mode & KBUF_MODE_FREE) > - kfree(arg->iovs); > arg->iovs = iov; > nr_iovs = nr_avail; > } else if (nr_avail < nr_iovs) { > @@ -330,6 +328,9 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, > buf = io_ring_head_to_buf(br, ++head, bl->mask); > } while (--nr_iovs); > > + if (arg->mode & KBUF_MODE_FREE) > + kfree(org_iovs); > + > if (head == tail) > req->flags |= REQ_F_BL_EMPTY; > > > > -- > Jens Axboe