io_uring: drop file refs after task cancel

io_uring fds marked O_CLOEXEC and we explicitly cancel all requests
before going through exec, so we don't want to leave task's file
references to not our anymore io_uring instances.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 445035b24a50793474ef04990062ddd9ec1c9a3d..85de42c4243359129b046578b52c856133413288 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8958,6 +8958,15 @@ static void io_uring_attempt_task_drop(struct file *file)
                io_uring_del_task_file(file);
 }
 
+static void io_uring_remove_task_files(struct io_uring_task *tctx)
+{
+       struct file *file;
+       unsigned long index;
+
+       xa_for_each(&tctx->xa, index, file)
+               io_uring_del_task_file(file);
+}
+
 void __io_uring_files_cancel(struct files_struct *files)
 {
        struct io_uring_task *tctx = current->io_uring;
@@ -8966,16 +8975,12 @@ void __io_uring_files_cancel(struct files_struct *files)
 
        /* make sure overflow events are dropped */
        atomic_inc(&tctx->in_idle);
-
-       xa_for_each(&tctx->xa, index, file) {
-               struct io_ring_ctx *ctx = file->private_data;
-
-               io_uring_cancel_task_requests(ctx, files);
-               if (files)
-                       io_uring_del_task_file(file);
-       }
-
+       xa_for_each(&tctx->xa, index, file)
+               io_uring_cancel_task_requests(file->private_data, files);
        atomic_dec(&tctx->in_idle);
+
+       if (files)
+               io_uring_remove_task_files(tctx);
 }
 
 static s64 tctx_inflight(struct io_uring_task *tctx)
@@ -9038,6 +9043,8 @@ void __io_uring_task_cancel(void)
        } while (1);
 
        atomic_dec(&tctx->in_idle);
+
+       io_uring_remove_task_files(tctx);
 }
 
 static int io_uring_flush(struct file *file, void *data)