Commit 9d9e88a2 authored May 13, 2020 by Jens Axboe

io_uring: polled fixed file must go through free iteration



When we changed the file registration handling, it became important to
iterate the bulk request freeing list for fixed files as well, or we
miss dropping the fixed file reference. If not, we're leaking references,
and we'll get a kworker stuck waiting for file references to disappear.

This also means we can remove the special casing of fixed vs non-fixed
files, we need to iterate for both and we can just rely on
__io_req_aux_free() doing io_put_file() instead of doing it manually.

Fixes: 05589553 ("io_uring: refactor file register/unregister/update handling")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

parent c9687426

fs/io_uring.c

+1 −5

Original line number	Diff line number	Diff line
		@@ -1394,10 +1394,6 @@ static void io_free_req_many(struct io_ring_ctx ctx, struct req_batch rb)
		for (i = 0; i < rb->to_free; i++) {
		struct io_kiocb *req = rb->reqs[i];

		if (req->flags & REQ_F_FIXED_FILE) {
		req->file = NULL;
		percpu_ref_put(req->fixed_file_refs);
		}
		if (req->flags & REQ_F_INFLIGHT)
		inflight++;
		__io_req_aux_free(req);
		@@ -1670,7 +1666,7 @@ static inline bool io_req_multi_free(struct req_batch rb, struct io_kiocb req)
		if ((req->flags & REQ_F_LINK_HEAD) \|\| io_is_fallback_req(req))
		return false;

		if (!(req->flags & REQ_F_FIXED_FILE) \|\| req->io)
		if (req->file \|\| req->io)
		rb->need_iter++;

		rb->reqs[rb->to_free++] = req;

Admin message