+++ /dev/null
-From 5f798beaf35d79355cbf18019c1993a84475a2c3 Mon Sep 17 00:00:00 2001
-From: Pavel Begunkov <asml.silence@gmail.com>
-Date: Sat, 8 Feb 2020 13:28:02 +0300
-Subject: io_uring: fix double prep iovec leak
-
-From: Pavel Begunkov <asml.silence@gmail.com>
-
-commit 5f798beaf35d79355cbf18019c1993a84475a2c3 upstream.
-
-Requests may be prepared multiple times with ->io allocated (i.e. async
-prepared). Preparation functions don't handle it and forget about
-previously allocated resources. This may happen in case of:
-- spurious defer_check
-- non-head (i.e. async prepared) request executed in sync (via nxt).
-
-Make the handlers check, whether they already allocated resources, which
-is true IFF REQ_F_NEED_CLEANUP is set.
-
-Cc: stable@vger.kernel.org # 5.5
-Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
-Signed-off-by: Jens Axboe <axboe@kernel.dk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- fs/io_uring.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
---- a/fs/io_uring.c
-+++ b/fs/io_uring.c
-@@ -1816,7 +1816,8 @@ static int io_read_prep(struct io_kiocb
- if (unlikely(!(req->file->f_mode & FMODE_READ)))
- return -EBADF;
-
-- if (!req->io)
-+ /* either don't need iovec imported or already have it */
-+ if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
- return 0;
-
- io = req->io;
-@@ -1903,7 +1904,8 @@ static int io_write_prep(struct io_kiocb
- if (unlikely(!(req->file->f_mode & FMODE_WRITE)))
- return -EBADF;
-
-- if (!req->io)
-+ /* either don't need iovec imported or already have it */
-+ if (!req->io || req->flags & REQ_F_NEED_CLEANUP)
- return 0;
-
- io = req->io;
-@@ -2649,6 +2651,9 @@ static int io_poll_wake(struct wait_queu
- /* for instances that support it check for an event match first: */
- if (mask && !(mask & poll->events))
- return 0;
-+ /* iovec is already imported */
-+ if (req->flags & REQ_F_NEED_CLEANUP)
-+ return 0;
-
- list_del_init(&poll->wait.entry);
-
-@@ -3151,6 +3156,9 @@ static int io_req_defer(struct io_kiocb
- /* Still need defer if there is pending req in defer list. */
- if (!req_need_defer(req) && list_empty(&ctx->defer_list))
- return 0;
-+ /* iovec is already imported */
-+ if (req->flags & REQ_F_NEED_CLEANUP)
-+ return 0;
-
- if (!req->io && io_alloc_async_ctx(req))
- return -EAGAIN;