Blob Blame History Raw
From e71d7c56dd69f720169c1675f87a1d22d8167767 Mon Sep 17 00:00:00 2001
From: Hao Xu <howeyxu@tencent.com>
Date: Sat, 11 Jun 2022 20:22:20 +0800
Subject: [PATCH] io_uring: openclose: fix bug of closing wrong fixed file
Git-commit: e71d7c56dd69f720169c1675f87a1d22d8167767
Patch-mainline: v5.19-rc3
References: bsc#1205205

Don't update ret until fixed file is closed, otherwise the file slot
becomes the error code.

Fixes: a7c41b4687f5 ("io_uring: let IORING_OP_FILES_UPDATE support choosing fixed file slots")
Signed-off-by: Hao Xu <howeyxu@tencent.com>
[pavel: 5.19 rebase]
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
---
 fs/io_uring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c
index fd8a1ffe6a1a..e6d8cafdd28e 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8035,8 +8035,8 @@ static int io_files_update_with_index_alloc(struct io_kiocb *req,
 		if (ret < 0)
 			break;
 		if (copy_to_user(&fds[done], &ret, sizeof(ret))) {
-			ret = -EFAULT;
 			__io_close_fixed(req, issue_flags, ret);
+			ret = -EFAULT;
 			break;
 		}
 	}
-- 
2.35.3