io_uring: drop 'ctx' ref on task work cancelation

If task_work ends up being marked for cancelation, we go through a cancelation helper instead of the queue path. In converting task_work to always hold a ctx reference, this path was missed. Make sure that io_req_task_cancel() puts the reference that is being held against the ctx. Fixes: 6d816e0 ("io_uring: hold 'ctx' reference around task_work queue + execute") Signed-off-by: Jens Axboe <[email protected]>
torvalds · Sep 14, 2020 · 87ceb6a · 87ceb6a
1 parent 202700e
commit 87ceb6a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/fs/io_uring.c b/fs/io_uring.c
@@ -1787,8 +1787,10 @@ static void __io_req_task_cancel(struct io_kiocb *req, int error)
 static void io_req_task_cancel(struct callback_head *cb)
 {
  struct io_kiocb *req = container_of(cb, struct io_kiocb, task_work);
+ struct io_ring_ctx *ctx = req->ctx;
 
  __io_req_task_cancel(req, -ECANCELED);
+ percpu_ref_put(&ctx->refs);
 }
 
 static void __io_req_task_submit(struct io_kiocb *req)