Re: [PATCH] io_uring: fix fs cleanup on cqe overflow

[Jens Axboe <axboe@xxxxxxxxx>]

On 4/8/20 10:17 PM, Pavel Begunkov wrote:
> If completion queue overflow happened, __io_cqring_fill_event() will
> update req->cflags, which is in a union with req->work and happend to
> be aliased to req->work.fs. Following io_free_req() ->
> io_req_work_drop_env() may get a bunch of different problems (miscount
> fs->users, segfault, etc) on cleaning @fs.

Good catch, applied.

-- 
Jens Axboe