io_uring/rsrc: fix lost entries after cloned range

JIRA: https://issues.redhat.com/browse/RHEL-141266

commit 525916ce496615f531091855604eab9ca573b195
Author: Joanne Koong <joannelkoong@gmail.com>
Date:   Thu Dec 4 13:51:16 2025 -0800

    io_uring/rsrc: fix lost entries after cloned range
    
    When cloning with node replacements (IORING_REGISTER_DST_REPLACE),
    destination entries after the cloned range are not copied over.
    
    Add logic to copy them over to the new destination table.
    
    Fixes: c1329532d5aa ("io_uring/rsrc: allow cloning with node replacements")
    Cc: stable@vger.kernel.org
    Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

Signed-off-by: Jeff Moyer <jmoyer@redhat.com>
This commit is contained in:
Jeff Moyer
2026-01-14 12:00:18 -05:00
parent d9740e280a
commit c5cbd4968b
+11 -1
View File
@@ -994,7 +994,7 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
if (ret)
return ret;
/* Fill entries in data from dst that won't overlap with src */
/* Copy original dst nodes from before the cloned range */
for (i = 0; i < min(arg->dst_off, ctx->buf_table.nr); i++) {
struct io_rsrc_node *src_node = ctx->buf_table.nodes[i];
@@ -1042,6 +1042,16 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
i++;
}
/* Copy original dst nodes from after the cloned range */
for (i = nbufs; i < ctx->buf_table.nr; i++) {
struct io_rsrc_node *node = ctx->buf_table.nodes[i];
if (node) {
data.nodes[i] = node;
node->refs++;
}
}
/*
* If asked for replace, put the old table. data->nodes[] holds both
* old and new nodes at this point.