Commit 7b53d598 authored May 30, 2020 by Pavel Begunkov Committed by Jens Axboe May 30, 2020

io_uring: fix overflowed reqs cancellation



Overflowed requests in io_uring_cancel_files() should be shed only of
inflight and overflowed refs. All other left references are owned by
someone else.

If refcount_sub_and_test() fails, it will go further and put put extra
ref, don't do that. Also, don't need to do io_wq_cancel_work()
for overflowed reqs, they will be let go shortly anyway.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent bfe68a22

fs/io_uring.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -7449,10 +7449,11 @@ static void io_uring_cancel_files(struct io_ring_ctx *ctx,
		finish_wait(&ctx->inflight_wait, &wait);
		continue;
		}
		}

		} else {
		io_wq_cancel_work(ctx->io_wq, &cancel_req->work);
		io_put_req(cancel_req);
		}

		schedule();
		finish_wait(&ctx->inflight_wait, &wait);
		}

Admin message