1 files changed, 9 insertions, 8 deletions

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 18cecb6a0151..84efb8956734 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2443,7 +2443,7 @@ static int io_sqe_buffer_unregister(struct io_ring_ctx *ctx)
 
                 if (ctx->account_mem)
                         io_unaccount_mem(ctx->user, imu->nr_bvecs);
-                kfree(imu->bvec);
+                kvfree(imu->bvec);
                 imu->nr_bvecs = 0;
         }
 
@@ -2535,9 +2535,9 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                 if (!pages || nr_pages > got_pages) {
                         kfree(vmas);
                         kfree(pages);
-                        pages = kmalloc_array(nr_pages, sizeof(struct page *),
+                        pages = kvmalloc_array(nr_pages, sizeof(struct page *),
                                                 GFP_KERNEL);
-                        vmas = kmalloc_array(nr_pages,
+                        vmas = kvmalloc_array(nr_pages,
                                         sizeof(struct vm_area_struct *),
                                         GFP_KERNEL);
                         if (!pages || !vmas) {
@@ -2549,7 +2549,7 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                         got_pages = nr_pages;
                 }
 
-                imu->bvec = kmalloc_array(nr_pages, sizeof(struct bio_vec),
+                imu->bvec = kvmalloc_array(nr_pages, sizeof(struct bio_vec),
                                                 GFP_KERNEL);
                 ret = -ENOMEM;
                 if (!imu->bvec) {
@@ -2588,6 +2588,7 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
                         }
                         if (ctx->account_mem)
                                 io_unaccount_mem(ctx->user, nr_pages);
+                        kvfree(imu->bvec);
                         goto err;
                 }
 
@@ -2610,12 +2611,12 @@ static int io_sqe_buffer_register(struct io_ring_ctx *ctx, void __user *arg,
 
                 ctx->nr_user_bufs++;
         }
-        kfree(pages);
-        kfree(vmas);
+        kvfree(pages);
+        kvfree(vmas);
         return 0;
 err:
-        kfree(pages);
-        kfree(vmas);
+        kvfree(pages);
+        kvfree(vmas);
         io_sqe_buffer_unregister(ctx);
         return ret;
 }