diff options
| author | Jens Axboe <axboe@kernel.dk> | 2026-02-11 15:12:03 -0700 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 07:20:54 -0500 |
| commit | 2277776408b487f8c9bb95a5fc8268e501e1fb06 (patch) | |
| tree | 5c6a79ceb73f9ac0430b03cf5e1a703be4d75d61 | |
| parent | ee93c914826671b0e3c08d1aa26f5d70e500e658 (diff) | |
io_uring/filetable: clamp alloc_hint to the configured alloc range
[ Upstream commit a6bded921ed35f21b3f6bd8e629bf488499ca442 ]
Explicit fixed file install/remove operations on slots outside the
configured alloc range can corrupt alloc_hint via io_file_bitmap_set()
and io_file_bitmap_clear(), which unconditionally update alloc_hint to
the bit position. This causes subsequent auto-allocations to fall
outside the configured range.
For example, if the alloc range is [10, 20) and a file is removed at
slot 2, alloc_hint gets set to 2. The next auto-alloc then starts
searching from slot 2, potentially returning a slot below the range.
Fix this by clamping alloc_hint to [file_alloc_start, file_alloc_end)
at the top of io_file_bitmap_get() before starting the search.
Cc: stable@vger.kernel.org
Fixes: 6e73dffbb93c ("io_uring: let to set a range for file slot allocation")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | io_uring/filetable.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/io_uring/filetable.c b/io_uring/filetable.c index f9e59c650e89..6a4d0bece0c7 100644 --- a/io_uring/filetable.c +++ b/io_uring/filetable.c @@ -22,6 +22,10 @@ static int io_file_bitmap_get(struct io_ring_ctx *ctx) if (!table->bitmap) return -ENFILE; + if (table->alloc_hint < ctx->file_alloc_start || + table->alloc_hint >= ctx->file_alloc_end) + table->alloc_hint = ctx->file_alloc_start; + do { ret = find_next_zero_bit(table->bitmap, nr, table->alloc_hint); if (ret != nr) |