From: Jens Axboe <axboe@kernel.dk>
Date: Mon, 20 Apr 2026 14:06:00 +0000 (+0000)
Subject: io_uring: fix spurious fput in registered ring path
X-Git-Tag: v7.1-rc1~11^2~10
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=8e1f412b5bc690cb72b3303a1ae0d42955e5e2b3;p=thirdparty%2Fkernel%2Flinux.git

io_uring: fix spurious fput in registered ring path

Fix an issue with io_uring_ctx_get_file() not gating fput() on whether
or not the file descriptor is a registered/direct one or not.

Fixes: c5e9f6a96bf7 ("io_uring: unify getting ctx from passed in file descriptor")
Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index dd6326dc5f88..4ed998d60c09 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2575,7 +2575,8 @@ struct file *io_uring_ctx_get_file(unsigned int fd, bool registered)
 		return ERR_PTR(-EBADF);
 	if (io_is_uring_fops(file))
 		return file;
-	fput(file);
+	if (!registered)
+		fput(file);
 	return ERR_PTR(-EOPNOTSUPP);
 }