io_uring: file switch work needs to get flushed on exit

We currently flush early, but if we have something in progress and a
new switch is scheduled, we need to ensure to flush after our teardown
as well.

Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 46cc1bc4806260a8194b374e7973f1dcd1512ac7..a0a58c181eaff105181a5921426ff247f7511f04 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5089,11 +5089,14 @@ static int io_sqe_files_unregister(struct io_ring_ctx *ctx)
                return -ENXIO;
 
        /* protect against inflight atomic switch, which drops the ref */
-       flush_work(&data->ref_work);
        percpu_ref_get(&data->refs);
+       /* wait for existing switches */
+       flush_work(&data->ref_work);
        percpu_ref_kill_and_confirm(&data->refs, io_file_ref_kill);
        wait_for_completion(&data->done);
        percpu_ref_put(&data->refs);
+       /* flush potential new switch */
+       flush_work(&data->ref_work);
        percpu_ref_exit(&data->refs);
 
        __io_sqe_files_unregister(ctx);