I really hope that we can't hit io_iopoll_try_reap_events() -> io_do_iopoll() -> io_iopoll_complete() -> io_queue_async_work() call chain (if we _can_, there's a lot of nasty stuff possible), but I don't see any robust proof that it'll never happen. Sure, there's that percpu_ref_is_dying(&ctx->refs) test in io_rw_should_reissue(), but what's to guarantee that it had been called after the matching percpu_ref_kill(&ctx->refs)? For that matter, what about the call from io_uring_cancel_generic() <- __io_uring_cancel() <- io_uring_files_cancel() <- do_exit()? What am I missing here?
