Merge 5.18-rc5 into driver-core-next

[linux-2.6-microblaze.git] / fs / io_uring.c

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 4479013..e01f595 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2797,11 +2797,10 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, bool force_nonspin)
                /* order with io_complete_rw_iopoll(), e.g. ->result updates */
                if (!smp_load_acquire(&req->iopoll_completed))
                        break;
+               nr_events++;
                if (unlikely(req->flags & REQ_F_CQE_SKIP))
                        continue;
-
                __io_fill_cqe_req(req, req->result, io_put_kbuf(req, 0));
-               nr_events++;
        }
 
        if (unlikely(!nr_events))
@@ -3784,6 +3783,7 @@ static int io_rw_init_file(struct io_kiocb *req, fmode_t mode)
                if (!(kiocb->ki_flags & IOCB_DIRECT) || !file->f_op->iopoll)
                        return -EOPNOTSUPP;
 
+               kiocb->private = NULL;
                kiocb->ki_flags |= IOCB_HIPRI | IOCB_ALLOC_CACHE;
                kiocb->ki_complete = io_complete_rw_iopoll;
                req->iopoll_completed = 0;
@@ -3832,8 +3832,10 @@ static int io_read(struct io_kiocb *req, unsigned int issue_flags)
                iovec = NULL;
        }
        ret = io_rw_init_file(req, FMODE_READ);
-       if (unlikely(ret))
+       if (unlikely(ret)) {
+               kfree(iovec);
                return ret;
+       }
        req->result = iov_iter_count(&s->iter);
 
        if (force_nonblock) {
@@ -3958,8 +3960,10 @@ static int io_write(struct io_kiocb *req, unsigned int issue_flags)
                iovec = NULL;
        }
        ret = io_rw_init_file(req, FMODE_WRITE);
-       if (unlikely(ret))
+       if (unlikely(ret)) {
+               kfree(iovec);
                return ret;
+       }
        req->result = iov_iter_count(&s->iter);
 
        if (force_nonblock) {
@@ -5204,6 +5208,8 @@ static int io_sendmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
                return -EINVAL;
+       if (unlikely(sqe->addr2 || sqe->file_index))
+               return -EINVAL;
 
        sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
        sr->len = READ_ONCE(sqe->len);
@@ -5415,6 +5421,8 @@ static int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 
        if (unlikely(req->ctx->flags & IORING_SETUP_IOPOLL))
                return -EINVAL;
+       if (unlikely(sqe->addr2 || sqe->file_index))
+               return -EINVAL;
 
        sr->umsg = u64_to_user_ptr(READ_ONCE(sqe->addr));
        sr->len = READ_ONCE(sqe->len);
@@ -10585,7 +10593,7 @@ static int io_ringfd_unregister(struct io_ring_ctx *ctx, void __user *__arg,
                        ret = -EFAULT;
                        break;
                }
-               if (reg.resv || reg.offset >= IO_RINGFD_REG_MAX) {
+               if (reg.resv || reg.data || reg.offset >= IO_RINGFD_REG_MAX) {
                        ret = -EINVAL;
                        break;
                }