@@ -7282,10 +7282,9 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
72827282 unsigned nr_args )
72837283{
72847284 __s32 __user * fds = (__s32 __user * ) arg ;
7285- unsigned nr_tables ;
7285+ unsigned nr_tables , i ;
72867286 struct file * file ;
7287- int fd , ret = 0 ;
7288- unsigned i ;
7287+ int fd , ret = - ENOMEM ;
72897288 struct fixed_file_ref_node * ref_node ;
72907289 struct fixed_file_data * file_data ;
72917290
@@ -7307,45 +7306,32 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
73077306 nr_tables = DIV_ROUND_UP (nr_args , IORING_MAX_FILES_TABLE );
73087307 file_data -> table = kcalloc (nr_tables , sizeof (file_data -> table ),
73097308 GFP_KERNEL );
7310- if (!file_data -> table ) {
7311- kfree (file_data );
7312- return - ENOMEM ;
7313- }
7309+ if (!file_data -> table )
7310+ goto out_free ;
73147311
73157312 if (percpu_ref_init (& file_data -> refs , io_file_ref_kill ,
7316- PERCPU_REF_ALLOW_REINIT , GFP_KERNEL )) {
7317- kfree (file_data -> table );
7318- kfree (file_data );
7319- return - ENOMEM ;
7320- }
7313+ PERCPU_REF_ALLOW_REINIT , GFP_KERNEL ))
7314+ goto out_free ;
73217315
7322- if (io_sqe_alloc_file_tables (file_data , nr_tables , nr_args )) {
7323- percpu_ref_exit (& file_data -> refs );
7324- kfree (file_data -> table );
7325- kfree (file_data );
7326- return - ENOMEM ;
7327- }
7316+ if (io_sqe_alloc_file_tables (file_data , nr_tables , nr_args ))
7317+ goto out_ref ;
73287318
73297319 for (i = 0 ; i < nr_args ; i ++ , ctx -> nr_user_files ++ ) {
73307320 struct fixed_file_table * table ;
73317321 unsigned index ;
73327322
7333- ret = - EFAULT ;
7334- if (copy_from_user (& fd , & fds [i ], sizeof (fd )))
7335- break ;
7323+ if (copy_from_user (& fd , & fds [i ], sizeof (fd ))) {
7324+ ret = - EFAULT ;
7325+ goto out_fput ;
7326+ }
73367327 /* allow sparse sets */
7337- if (fd == -1 ) {
7338- ret = 0 ;
7328+ if (fd == -1 )
73397329 continue ;
7340- }
73417330
7342- table = & file_data -> table [i >> IORING_FILE_TABLE_SHIFT ];
7343- index = i & IORING_FILE_TABLE_MASK ;
73447331 file = fget (fd );
7345-
73467332 ret = - EBADF ;
73477333 if (!file )
7348- break ;
7334+ goto out_fput ;
73497335
73507336 /*
73517337 * Don't allow io_uring instances to be registered. If UNIX
@@ -7356,28 +7342,13 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
73567342 */
73577343 if (file -> f_op == & io_uring_fops ) {
73587344 fput (file );
7359- break ;
7345+ goto out_fput ;
73607346 }
7361- ret = 0 ;
7347+ table = & file_data -> table [i >> IORING_FILE_TABLE_SHIFT ];
7348+ index = i & IORING_FILE_TABLE_MASK ;
73627349 table -> files [index ] = file ;
73637350 }
73647351
7365- if (ret ) {
7366- for (i = 0 ; i < ctx -> nr_user_files ; i ++ ) {
7367- file = io_file_from_index (ctx , i );
7368- if (file )
7369- fput (file );
7370- }
7371- for (i = 0 ; i < nr_tables ; i ++ )
7372- kfree (file_data -> table [i ].files );
7373-
7374- percpu_ref_exit (& file_data -> refs );
7375- kfree (file_data -> table );
7376- kfree (file_data );
7377- ctx -> nr_user_files = 0 ;
7378- return ret ;
7379- }
7380-
73817352 ctx -> file_data = file_data ;
73827353 ret = io_sqe_files_scm (ctx );
73837354 if (ret ) {
@@ -7397,6 +7368,21 @@ static int io_sqe_files_register(struct io_ring_ctx *ctx, void __user *arg,
73977368 spin_unlock (& file_data -> lock );
73987369 percpu_ref_get (& file_data -> refs );
73997370 return ret ;
7371+ out_fput :
7372+ for (i = 0 ; i < ctx -> nr_user_files ; i ++ ) {
7373+ file = io_file_from_index (ctx , i );
7374+ if (file )
7375+ fput (file );
7376+ }
7377+ for (i = 0 ; i < nr_tables ; i ++ )
7378+ kfree (file_data -> table [i ].files );
7379+ ctx -> nr_user_files = 0 ;
7380+ out_ref :
7381+ percpu_ref_exit (& file_data -> refs );
7382+ out_free :
7383+ kfree (file_data -> table );
7384+ kfree (file_data );
7385+ return ret ;
74007386}
74017387
74027388static int io_sqe_file_register (struct io_ring_ctx * ctx , struct file * file ,
0 commit comments