[RFC] what exactly prevents io_iopoll_try_reap_events() triggering io_queue_async_work()?

	I really hope that we can't hit io_iopoll_try_reap_events() ->
io_do_iopoll() -> io_iopoll_complete() -> io_queue_async_work() call
chain (if we _can_, there's a lot of nasty stuff possible), but I don't
see any robust proof that it'll never happen.

	Sure, there's that percpu_ref_is_dying(&ctx->refs) test in
io_rw_should_reissue(), but what's to guarantee that it had been
called after the matching percpu_ref_kill(&ctx->refs)?  For that
matter, what about the call from io_uring_cancel_generic() <-
__io_uring_cancel() <- io_uring_files_cancel() <- do_exit()?

	What am I missing here?