io_uring/timeout: splice timed out link in timeout handler

A previous commit deferred this to the task_work part of it, so it could
be protected by ->uring_lock. But that's actually not necessary here,
and in fact the head clearing is not enough to make that safe. For those
two reasons, just re-instate the local splicing.

Fixes: 49ae66eb8c27 ("io_uring: defer linked-timeout chain splice out of hrtimer context")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/timeout.c b/io_uring/timeout.c
index 6353a4d979dc0031ad568d3336d8e4034de69eb2..c4dd26cf342daea2878c01ec3f02a58c80a706ae 100644 (file)
--- a/io_uring/timeout.c
+++ b/io_uring/timeout.c
@@ -417,8 +417,10 @@ static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer)
         * done in io_req_task_link_timeout(), if needed.
         */
        if (prev) {
-               if (!req_ref_inc_not_zero(prev))
+               if (!req_ref_inc_not_zero(prev)) {
+                       io_remove_next_linked(prev);
                        prev = NULL;
+               }
        }
        list_del(&timeout->list);
        timeout->prev = prev;