tree e743d1a4eae20bbef5ddc149536f2360934ff041
parent c1edbf5f081be9fbbea68c1d564b773e59c1acf3
author Jens Axboe <axboe@kernel.dk> 1573443053 -0700
committer Jens Axboe <axboe@kernel.dk> 1573515197 -0700

io_uring: don't do flush cancel under inflight_lock

We can't safely cancel under the inflight lock. If the work hasn't been
started yet, then io_wq_cancel_work() simply marks the work as cancelled
and invokes the work handler. But if the work completion needs to grab
the inflight lock because it's grabbing user files, then we'll deadlock
trying to finish the work as we already hold that lock.

Instead grab a reference to the request, if it isn't already zero. If
it's zero, then we know it's going through completion anyway, and we
can safely ignore it. If it's not zero, then we can drop the lock and
attempt to cancel from there.

This also fixes a missing finish_wait() at the end of
io_uring_cancel_files().

Signed-off-by: Jens Axboe <axboe@kernel.dk>