io_uring/rsrc: clean up __io_sqe_buffers_update()
Inline offset variable, so we don't use it without subjecting it to array_index_nospec() first. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://lore.kernel.org/r/77936d9ed23755588810c5eafcea7e1c3b90e3cd.1681395792.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
parent
2f2af35f8e
commit
9a57fffedc
|
@ -469,7 +469,6 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
|
|||
|
||||
for (done = 0; done < nr_args; done++) {
|
||||
struct io_mapped_ubuf *imu;
|
||||
int offset = up->offset + done;
|
||||
u64 tag = 0;
|
||||
|
||||
err = io_copy_iov(ctx, &iov, iovs, done);
|
||||
|
@ -490,7 +489,7 @@ static int __io_sqe_buffers_update(struct io_ring_ctx *ctx,
|
|||
if (err)
|
||||
break;
|
||||
|
||||
i = array_index_nospec(offset, ctx->nr_user_bufs);
|
||||
i = array_index_nospec(up->offset + done, ctx->nr_user_bufs);
|
||||
if (ctx->user_bufs[i] != ctx->dummy_ubuf) {
|
||||
err = io_queue_rsrc_removal(ctx->buf_data, i,
|
||||
ctx->rsrc_node, ctx->user_bufs[i]);
|
||||
|
|
Loading…
Reference in New Issue