io_uring: fix missing io_queue_linked_timeout()

Whoever called io_prep_linked_timeout() should also do
io_queue_linked_timeout(). __io_queue_sqe() doesn't follow that for the
punting path leaving linked timeouts prepared but never queued.

Fixes: 6df1db6b54243 ("io_uring: fix mis-refcounting linked timeouts")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 59f1f473ffc720a74c71f56017ff0fa749fbcac0..3e406bc1f8550103101c7ab94809c767df1bec84 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -5987,20 +5987,20 @@ again:
         * doesn't support non-blocking read/write attempts
         */
        if (ret == -EAGAIN && !(req->flags & REQ_F_NOWAIT)) {
-               if (io_arm_poll_handler(req)) {
-                       if (linked_timeout)
-                               io_queue_linked_timeout(linked_timeout);
-                       goto exit;
-               }
+               if (!io_arm_poll_handler(req)) {
 punt:
-               ret = io_prep_work_files(req);
-               if (unlikely(ret))
-                       goto err;
-               /*
-                * Queued up for async execution, worker will release
-                * submit reference when the iocb is actually submitted.
-                */
-               io_queue_async_work(req);
+                       ret = io_prep_work_files(req);
+                       if (unlikely(ret))
+                               goto err;
+                       /*
+                        * Queued up for async execution, worker will release
+                        * submit reference when the iocb is actually submitted.
+                        */
+                       io_queue_async_work(req);
+               }
+
+               if (linked_timeout)
+                       io_queue_linked_timeout(linked_timeout);
                goto exit;
        }