diff options
| author | Jens Axboe <axboe@kernel.dk> | 2023-05-23 08:26:06 -0600 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-06-05 08:17:32 +0200 |
| commit | 9ba28194ea50707f282da264c0c351770ec40b3e (patch) | |
| tree | b94031fd3d44f0122edb16fcb116aa2ebff52871 | |
| parent | 6de3014d4bd8ff3e7017614741f2dbb02bca9361 (diff) | |
io_uring: have io_kill_timeout() honor the request references
No upstream commit exists for this patch.
Don't free the request unconditionally, if the request is issued async
then someone else may be holding a submit reference to it.
Reported-and-tested-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | fs/io_uring.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index 7dbc09e4c5e9..3683ddeb625a 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -551,7 +551,8 @@ static void io_kill_timeout(struct io_kiocb *req) atomic_inc(&req->ctx->cq_timeouts); list_del(&req->list); io_cqring_fill_event(req->ctx, req->user_data, 0); - __io_free_req(req); + if (refcount_dec_and_test(&req->refs)) + __io_free_req(req); } } |