Re: [PATCH] io_uring: fix NULL pointer dereference for async cancel close

[Pavel Begunkov <asml.silence@gmail.com>]

On 19/01/2021 01:58, Joseph Qi wrote:
>> Hmm, I hastened, for files we need IO_WQ_WORK_FILES,
>> +IO_WQ_WORK_BLKCG for same reasons. needs_file would make 
>> it to grab a struct file, that is wrong.
>> Probably worked out because it just grabbed fd=0/stdin.
>>
> 
> I think IO_WQ_WORK_FILES can work since it will acquire
> files when initialize async cancel request.

That the one controlling files in the first place, need_file
just happened to grab them submission.

> Don't quite understand why we should have IO_WQ_WORK_BLKCG.

Because it's set for IORING_OP_CLOSE, and similar situation
may happen but with async_cancel from io-wq.

Actually, it's even nastier than that, and neither of io_op_def
flags would work because for io-wq case you can end up doing
close() with different from original files. I'll think how it
can be done tomorrow.

-- 
Pavel Begunkov