io-wq: fix ref leak for req in case of exit cancelations

do_work such as io_wq_submit_work that cancel the work may leave a ref of
req as 1 if we have links. Fix it by call io_run_cancel.

Fixes: 4fb6ac326204 ("io-wq: improve manager/worker handling over exec")
Signed-off-by: yangerkun <yangerkun@huawei.com>
Link: https://lore.kernel.org/r/20210309030410.3294078-1-yangerkun@huawei.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io-wq.c b/fs/io-wq.c
index c2e7031f6d096c31faf7ade71c47d26be6ebe19f..3d7060ba547a03b8cec4b5e37e0e58f9409f25a4 100644 (file)
--- a/fs/io-wq.c
+++ b/fs/io-wq.c
@@ -799,8 +799,7 @@ static void io_wqe_enqueue(struct io_wqe *wqe, struct io_wq_work *work)
        /* Can only happen if manager creation fails after exec */
        if (io_wq_fork_manager(wqe->wq) ||
            test_bit(IO_WQ_BIT_EXIT, &wqe->wq->state)) {
-               work->flags |= IO_WQ_WORK_CANCEL;
-               wqe->wq->do_work(work);
+               io_run_cancel(work, wqe);
                return;
        }