Commit de7f1d9e authored by Pavel Begunkov's avatar Pavel Begunkov Committed by Jens Axboe
Browse files

io_uring: drop file refs after task cancel 



io_uring fds marked O_CLOEXEC and we explicitly cancel all requests
before going through exec, so we don't want to leave task's file
references to not our anymore io_uring instances.

Signed-off-by: default avatarPavel Begunkov <asml.silence@gmail.com>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent 6c503150

fs/io_uring.c

+16 −9
Original line number Diff line number Diff line
@@ -8958,6 +8958,15 @@ static void io_uring_attempt_task_drop(struct file *file) 
		io_uring_del_task_file(file);

}



static void io_uring_remove_task_files(struct io_uring_task *tctx)

{

	struct file *file;

	unsigned long index;



	xa_for_each(&tctx->xa, index, file)

		io_uring_del_task_file(file);

}



void __io_uring_files_cancel(struct files_struct *files)

{

	struct io_uring_task *tctx = current->io_uring;
@@ -8966,16 +8975,12 @@ void __io_uring_files_cancel(struct files_struct *files) 


	/* make sure overflow events are dropped */

	atomic_inc(&tctx->in_idle);

	xa_for_each(&tctx->xa, index, file)

		io_uring_cancel_task_requests(file->private_data, files);

	atomic_dec(&tctx->in_idle);



	xa_for_each(&tctx->xa, index, file) {

		struct io_ring_ctx *ctx = file->private_data;



		io_uring_cancel_task_requests(ctx, files);

	if (files)

			io_uring_del_task_file(file);

	}



	atomic_dec(&tctx->in_idle);

		io_uring_remove_task_files(tctx);

}



static s64 tctx_inflight(struct io_uring_task *tctx)
@@ -9038,6 +9043,8 @@ void __io_uring_task_cancel(void) 
	} while (1);



	atomic_dec(&tctx->in_idle);



	io_uring_remove_task_files(tctx);

}



static int io_uring_flush(struct file *file, void *data)