io_uring/rsrc: ignore dummy_ubuf for buffer cloning

For placeholder buffers, &dummy_ubuf is assigned which is a static
value. When buffers are attempted cloned, don't attempt to grab a
reference to it, as we both don't need it and it'll actively fail as
dummy_ubuf doesn't have a valid reference count setup.

Link: https://lore.kernel.org/io-uring/Zw8dkUzsxQ5LgAJL@ly-workstation/
Reported-by: Lai, Yi <[email protected]>
Fixes: 7cc2a6eadcd7 ("io_uring: add IORING_REGISTER_COPY_BUFFERS method")
Signed-off-by: Jens Axboe <[email protected]>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 33a3d156a85b14fa50f2c31d840f2fdbaabc8ca1..6f3b6de230bd2b43cf3f4c35ec6b431711a5c64b 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -1176,7 +1176,8 @@ static int io_clone_buffers(struct io_ring_ctx *ctx, struct io_ring_ctx *src_ctx
        for (i = 0; i < nbufs; i++) {
                struct io_mapped_ubuf *src = src_ctx->user_bufs[i];
 
-               refcount_inc(&src->refs);
+               if (src != &dummy_ubuf)
+                       refcount_inc(&src->refs);
                user_bufs[i] = src;
        }