summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJens Axboe <axboe@kernel.dk>2019-04-30 23:44:05 +0300
committerJens Axboe <axboe@kernel.dk>2019-05-01 17:38:47 +0300
commit817869d2519f0cb7be5b3482129dadc806dfb747 (patch)
tree6f5f784693b79fcfd0fa6a5c39e7a6d8d16a5137
parent52e04ef4c9d459cba3afd86ec335a411b40b7fd2 (diff)
downloadlinux-817869d2519f0cb7be5b3482129dadc806dfb747.tar.xz
io_uring: drop req submit reference always in async punt
If we don't end up actually calling submit in io_sq_wq_submit_work(), we still need to drop the submit reference to the request. If we don't, then we can leak the request. This can happen if we race with ring shutdown while flushing the workqueue for requests that require use of the mm_struct. Fixes: e65ef56db494 ("io_uring: use regular request ref counts") Signed-off-by: Jens Axboe <axboe@kernel.dk>
-rw-r--r--fs/io_uring.c7
1 files changed, 4 insertions, 3 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 046fc4e1e155..18cecb6a0151 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -1568,10 +1568,11 @@ restart:
break;
cond_resched();
} while (1);
-
- /* drop submission reference */
- io_put_req(req);
}
+
+ /* drop submission reference */
+ io_put_req(req);
+
if (ret) {
io_cqring_add_event(ctx, sqe->user_data, ret, 0);
io_put_req(req);