io_uring/rsrc: fix lost entries after cloned range

commit 525916ce496615f531091855604eab9ca573b195 upstream.

When cloning with node replacements (IORING_REGISTER_DST_REPLACE),
destination entries after the cloned range are not copied over.

Add logic to copy them over to the new destination table.

Fixes: c1329532d5aa ("io_uring/rsrc: allow cloning with node replacements")
Cc: stable@vger.kernel.org
Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 5b6b73c6a62bdc22ee14224e9903a0e2bcde19e3..160b4de2d00d3c3d6c6ee7f5f0d39b742d392d26 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1200,7 +1200,7 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
        if (ret)
                return ret;
 
-       /* Fill entries in data from dst that won't overlap with src */
+       /* Copy original dst nodes from before the cloned range */
        for (i = 0; i < min(arg->dst_off, ctx->buf_table.nr); i++) {
                struct io_rsrc_node *src_node = ctx->buf_table.nodes[i];
 
@@ -1248,6 +1248,16 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
                i++;
        }
 
+       /* Copy original dst nodes from after the cloned range */
+       for (i = nbufs; i < ctx->buf_table.nr; i++) {
+               struct io_rsrc_node *node = ctx->buf_table.nodes[i];
+
+               if (node) {
+                       data.nodes[i] = node;
+                       node->refs++;
+               }
+       }
+
        /*
         * If asked for replace, put the old table. data->nodes[] holds both
         * old and new nodes at this point.