io_uring: have io_kill_timeout() honor the request references

No upstream commit exists for this patch.

Don't free the request unconditionally, if the request is issued async
then someone else may be holding a submit reference to it.

Reported-and-tested-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 7dbc09e4c5e94363023380145bdb22558de37340..3683ddeb625aeeab25a958a018471a39b882ef15 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -551,7 +551,8 @@ static void io_kill_timeout(struct io_kiocb *req)
                atomic_inc(&req->ctx->cq_timeouts);
                list_del(&req->list);
                io_cqring_fill_event(req->ctx, req->user_data, 0);
-               __io_free_req(req);
+               if (refcount_dec_and_test(&req->refs))
+                       __io_free_req(req);
        }
 }