[PATCH] io_uring: cancel pending poll activation on ring exit

[Zhao Gongyi]

The first poll of a DEFER_TASKRUN ring queues activation task_work on
its submitter and takes a ctx reference. If the ring closes while the
work is pending and the submitter cannot run it, exit_work waits for
the reference and eventually warns.

Cancel pending activation before waiting for refs. If cancellation
succeeds, release its reference here; otherwise the callback does it.

Fixes: bca39f390585 ("io_uring: add lazy poll_wq activation")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Zhao Gongyi <zhaogongyi@xxxxxxxxxxxxx>
---
 io_uring/io_uring.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 5db57bf675f0..bdf996955f68 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2593,6 +2593,10 @@ static __cold void io_ring_exit_work(struct work_struct *work)
 	struct io_tctx_node *node;
 	int ret;
 
+	if (ctx->submitter_task &&
+	    task_work_cancel(ctx->submitter_task, &ctx->poll_wq_task_work))
+		percpu_ref_put(&ctx->refs);
+
 	do {
 		io_ring_ctx_cancel(ctx);
 

base-commit: 39c7210e970200f8b17de3767c73efe64173a95f
-- 
2.39.5 (Apple Git-154)