On Mon, Mar 11, 2019 at 08:58:31PM +0100, Christoph Hellwig wrote: > Where do we put the second iocb reference in case we return from > vfs_poll without ever being woken? Depends. If mask is non-zero (i.e. vfs_poll() has returned something we care about) and it has never been woken, we steal it and drop the reference ourselves. If it is zero and we see that ->poll() has tried to put it on two queues, we steal it (again, assuming it's not on waitqueue and _can_ be stolen) and return -EINVAL. In that case __io_submit_one() (or, by the end of the series, io_submit_one()) will call iocb_destroy(). And in the normal waiting case (nothing interesting reported and no errors) it will end up on the list of cancellables. Then it either will get completed by later wakeup, which will drop the reference, or it will get eventually cancelled, which will hit the same aio_poll_complete_work() and drop the reference... > Also it seems like the complete code would still benefit from a little > helper, something like: Umm... Not sure I like the name (something like aio_poll_done() seems to be better), but other than that - no problem.
