From: Jens Axboe <axboe@xxxxxxxxx> [ Upstream commit 84965ff8a84f0368b154c9b367b62e59c1193f30 ] Ensure we match tasks that belong to a dead or dying task as well, as we need to reap those in addition to those belonging to the exiting task. Cc: stable@xxxxxxxxxxxxxxx # 5.9+ Reported-by: Josef Grieb <josef.grieb@xxxxxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- fs/io_uring.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1014,8 +1014,12 @@ static bool io_match_task(struct io_kioc { struct io_kiocb *link; - if (task && head->task != task) + if (task && head->task != task) { + /* in terms of cancelation, always match if req task is dead */ + if (head->task->flags & PF_EXITING) + return true; return false; + } if (!files) return true; if (__io_match_files(head, files)) @@ -8844,6 +8848,9 @@ static int io_uring_flush(struct file *f struct io_uring_task *tctx = current->io_uring; struct io_ring_ctx *ctx = file->private_data; + if (fatal_signal_pending(current) || (current->flags & PF_EXITING)) + io_uring_cancel_task_requests(ctx, NULL); + if (!tctx) return 0;