diff options
| author |   Pavel Begunkov <asml.silence@gmail.com> | 2019-11-19 23:32:50 +0300 |
|---|---|---|
| committer |   Jens Axboe <axboe@kernel.dk> | 2019-11-25 19:56:06 -0700 |
| commit | 09fbb0a83ec6ab5a4037766261c031151985fff6 (patch) | |
| tree | b69a9e99f4743f4ca13c0ce3d14044b18ac65d30 /fs/io_uring.c | |
| parent | io_uring: remove redundant check (diff) | |
| download | linux-dev-09fbb0a83ec6ab5a4037766261c031151985fff6.tar.xz linux-dev-09fbb0a83ec6ab5a4037766261c031151985fff6.zip | |
io_uring: Fix leaking linked timeouts
let have a dependant link: REQ -> LINK_TIMEOUT -> LINK_TIMEOUT
1. submission stage: submission references for REQ and LINK_TIMEOUT
are dropped. So, references respectively (1,1,2)
2. io_put(REQ) + FAIL_LINKS stage: calls io_fail_links(), which for all
linked timeouts will call cancel_timeout() and drop 1 reference.
So, references after: (0,0,1). That's a leak.
Make it treat only the first linked timeout as such, and pass others
through __io_double_put_req().
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'fs/io_uring.c')
| -rw-r--r-- | fs/io_uring.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/fs/io_uring.c b/fs/io_uring.c index fd60939a8a59..f88e12b971c7 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -942,6 +942,7 @@ static void io_fail_links(struct io_kiocb *req) if ((req->flags & REQ_F_LINK_TIMEOUT) && link->submit.sqe->opcode == IORING_OP_LINK_TIMEOUT) { io_link_cancel_timeout(link); + req->flags &= ~REQ_F_LINK_TIMEOUT; } else { io_cqring_fill_event(link, -ECANCELED); __io_double_put_req(link); |