If io_sqe_files_register is called but returns EFAULT or EBADF the io_ring_ctx user_files member is cleaned up, but a following call to io_sqe_files_unregister will double-free.
Dan Robertson (1): io_uring: fix bad free in io_sqe_files_register fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) -- 2.21.0
