From: Pavel Begunkov <asml.silence@gmail.com>
Date: Sun, 12 Jun 2022 13:31:38 +0000 (+0100)
Subject: io_uring: fix double unlock for pbuf select
X-Git-Tag: v5.19-rc3~19^2~12^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fc9375e3f763b06c3c90c5f5b2b84d3e07c1f4c2;p=thirdparty%2Fkernel%2Flinux.git

io_uring: fix double unlock for pbuf select

io_buffer_select(), which is the only caller of io_ring_buffer_select(),
fully handles locking, mutex unlock in io_ring_buffer_select() will lead
to double unlock.

Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 84b45ed91b2d3..4719eaee3b453 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -3849,10 +3849,8 @@ static void __user *io_ring_buffer_select(struct io_kiocb *req, size_t *len,
 	struct io_uring_buf *buf;
 	__u32 head = bl->head;
 
-	if (unlikely(smp_load_acquire(&br->tail) == head)) {
-		io_ring_submit_unlock(req->ctx, issue_flags);
+	if (unlikely(smp_load_acquire(&br->tail) == head))
 		return NULL;
-	}
 
 	head &= bl->mask;
 	if (head < IO_BUFFER_LIST_BUF_PER_PAGE) {