io_uring/rsrc: call io_free_node() on io_sqe_buffer_register() failure

io_sqe_buffer_register() currently calls io_put_rsrc_node() if it fails
to fully set up the io_rsrc_node. io_put_rsrc_node() is more involved
than necessary, since we already know the reference count will reach 0
and no io_mapped_ubuf has been attached to the node yet.

So just call io_free_node() to release the node's memory. This also
avoids the need to temporarily set the node's buf pointer to NULL.

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Link: https://lore.kernel.org/r/20250228235916.670437-3-csander@purestorage.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rsrc.c b/io_uring/rsrc.c
index 19e9de040a2006c492997b18c2866a4aa77ce169..8c1717c53d672fd7d128fa9ba4229997073cd2d9 100644 (file)
--- a/io_uring/rsrc.c
+++ b/io_uring/rsrc.c
@@ -782,7 +782,6 @@ static struct io_rsrc_node *io_sqe_buffer_register(struct io_ring_ctx *ctx,
        node = io_rsrc_node_alloc(ctx, IORING_RSRC_BUFFER);
        if (!node)
                return ERR_PTR(-ENOMEM);
-       node->buf = NULL;
 
        ret = -ENOMEM;
        pages = io_pin_pages((unsigned long) iov->iov_base, iov->iov_len,
@@ -839,7 +838,7 @@ done:
                if (imu)
                        io_free_imu(ctx, imu);
                if (node)
-                       io_put_rsrc_node(ctx, node);
+                       io_free_node(ctx, node);
                node = ERR_PTR(ret);
        }
        kvfree(pages);