From c835053c99074197d55857c6db5576a3f0ac1c08 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Tue, 23 May 2023 08:26:06 -0600 Subject: [PATCH 3/3] io_uring: have io_kill_timeout() honor the request references No upstream commit exists for this patch. Don't free the request unconditionally, if the request is issued async then someone else may be holding a submit reference to it. Reported-and-tested-by: Lee Jones Signed-off-by: Jens Axboe --- fs/io_uring.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index 7dbc09e4c5e9..3683ddeb625a 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -551,7 +551,8 @@ static void io_kill_timeout(struct io_kiocb *req) atomic_inc(&req->ctx->cq_timeouts); list_del(&req->list); io_cqring_fill_event(req->ctx, req->user_data, 0); - __io_free_req(req); + if (refcount_dec_and_test(&req->refs)) + __io_free_req(req); } } -- 2.39.2