io_uring: add warn_once for io_uring_flush()

files_cancel() should cancel all relevant requests and drop file notes,
so we should never have file notes after that, including on-exit fput
and flush. Add a WARN_ONCE to be sure.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 1c931e7a3948fd4cd7be130ef9a7159dd61a4c5d..f39671a0d84f6beda0af626711162dfab00fab93 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -9055,17 +9055,23 @@ void __io_uring_task_cancel(void)
 
 static int io_uring_flush(struct file *file, void *data)
 {
-       if (!current->io_uring)
+       struct io_uring_task *tctx = current->io_uring;
+
+       if (!tctx)
                return 0;
 
+       /* we should have cancelled and erased it before PF_EXITING */
+       WARN_ON_ONCE((current->flags & PF_EXITING) &&
+                    xa_load(&tctx->xa, (unsigned long)file));
+
        /*
         * fput() is pending, will be 2 if the only other ref is our potential
         * task file note. If the task is exiting, drop regardless of count.
         */
-       if (fatal_signal_pending(current) || (current->flags & PF_EXITING) ||
-           atomic_long_read(&file->f_count) == 2)
-               io_uring_del_task_file(file);
+       if (atomic_long_read(&file->f_count) != 2)
+               return 0;
 
+       io_uring_del_task_file(file);
        return 0;
 }