From 3f1e3e7dbd542cf97eaeebe57c084660feb91c21 Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Tue, 30 Apr 2019 14:44:05 -0600 Subject: [PATCH 0474/2944] io_uring: drop req submit reference always in async punt commit 817869d2519f0cb7be5b3482129dadc806dfb747 upstream. If we don't end up actually calling submit in io_sq_wq_submit_work(), we still need to drop the submit reference to the request. If we don't, then we can leak the request. This can happen if we race with ring shutdown while flushing the workqueue for requests that require use of the mm_struct. Fixes: e65ef56db494 ("io_uring: use regular request ref counts") Signed-off-by: Jens Axboe Signed-off-by: Joseph Qi Reviewed-by: Jeffle Xu Acked-by: Caspar Zhang --- fs/io_uring.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/fs/io_uring.c b/fs/io_uring.c index b421586..939c09c8 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1568,10 +1568,11 @@ static void io_sq_wq_submit_work(struct work_struct *work) break; cond_resched(); } while (1); - - /* drop submission reference */ - io_put_req(req); } + + /* drop submission reference */ + io_put_req(req); + if (ret) { io_cqring_add_event(ctx, sqe->user_data, ret, 0); io_put_req(req); -- 1.8.3.1