tree 9b190617debbf49a367e0c759348e6d5864380c6
parent 90055509b30a654258e8172bd244612961537488
author Pavel Begunkov <asml.silence@gmail.com> 1654760075 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1656773095 +0200

io_uring: fix not locked access to fixed buf table

commit 05b538c1765f8d14a71ccf5f85258dcbeaf189f7 upstream.

We can look inside the fixed buffer table only while holding
->uring_lock, however in some cases we don't do the right async prep for
IORING_OP_{WRITE,READ}_FIXED ending up with NULL req->imu forcing making
an io-wq worker to try to resolve the fixed buffer without proper
locking.

Move req->imu setup into early req init paths, i.e. io_prep_rw(), which
is called unconditionally for rw requests and under uring_lock.

Fixes: 634d00df5e1cf ("io_uring: add full-fledged dynamic buffers support")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>