On 5/26/20 11:34 AM, Pavel Begunkov wrote: > In io_uring_cancel_files(), after refcount_sub_and_test() leaves 0 > req->refs, it calls io_put_req(), which would also put a ref. Call > io_free_req() instead. Needs a: Fixes: 2ca10259b418 ("io_uring: prune request from overflow list on flush") I added it. -- Jens Axboe