io_uring: fix cancel of deferred reqs with ->files

	io_timeout_remove_link(ctx, req);

}

static void io_cancel_defer_files(struct io_ring_ctx *ctx,

				  struct files_struct *files)

{

	struct io_defer_entry *de = NULL;

	LIST_HEAD(list);

	spin_lock_irq(&ctx->completion_lock);

	list_for_each_entry_reverse(de, &ctx->defer_list, list) {

		if ((de->req->flags & REQ_F_WORK_INITIALIZED)

			&& de->req->work.files == files) {

			list_cut_position(&list, &ctx->defer_list, &de->list);

			break;

		}

	}

	spin_unlock_irq(&ctx->completion_lock);

	while (!list_empty(&list)) {

		de = list_first_entry(&list, struct io_defer_entry, list);

		list_del_init(&de->list);

		req_set_fail_links(de->req);

		io_put_req(de->req);

		io_req_complete(de->req, -ECANCELED);

		kfree(de);

	}

}

static void io_uring_cancel_files(struct io_ring_ctx *ctx,

				  struct files_struct *files)

{

	if (list_empty_careful(&ctx->inflight_list))

		return;

	io_cancel_defer_files(ctx, files);

	/* cancel all at once, should be faster than doing it one by one*/

	io_wq_cancel_cb(ctx->io_wq, io_wq_files_match, files, true);