GitLab

From: Jerzy Szczepkowski <js189202@zodiac.mimuw.edu.pl>

There is a bug in sys_io_setup().

If ioctx_alloc() succeeds and put_user() fails io_destroy() is called.
io_destroy() assumes that ioctx->users >= 2 (if context is alive) and calls
put_ioctx twice, while in this sequence ioctx->users == 1.
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>