On Thu, Mar 12, 2020 at 10:49:40AM +0000, David Howells wrote:

Christoph Hellwig [off-list ref] wrote:

quoted

quoted

quoted

at the end of the function - but surely iocb should be expected to have
been freed when iocb->ki_complete() was called?

The iocb is refcounted and only completed when the refcount hits zero,
and an extra reference is held until the submission has completed.
Take a look at iocb_put().

Ah...  This is in struct aio_kiocb and not struct kiocb - that's why I missed
it.  Thanks.

That being said we have a few other spots using ->ki_complete for
asynchronous execution, which might not be as careful.  As someone
having written one or two of those I have my doubts I got everthing
right and will audit those.

David

---end quoted text---