src/register: clean up ring state on failed resize mmap
If io_uring_resize_rings() succeeds in the kernel but the subsequent
mmap call fails, sq/cq may hold stale or error-encoded pointers such
as ring_ptr = (void *)-ENOMEM. A later call to io_uring_queue_exit()
would pass these to munmap, resulting in undefined behaviour.
Zero out sq and cq before calling io_uring_queue_exit() so that the
cleanup path is safe regardless of which mappings were established.
Fixes: https://github.com/axboe/liburing/issues/1574
Signed-off-by: Ahmed Abdelmoemen <ahmedabdelmoumen05@gmail.com>
1 file changed