As with ctx refs, on resurrect wait for potentially concurrently running ->release().

Cc: stable@vger.kernel.org # 5.10+ Signed-off-by: Pavel Begunkov asml.silence@gmail.com --- fs/io_uring.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c index 6ea4633e5ed5..c08d32523f79 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -7368,13 +7368,11 @@ static int io_rsrc_ref_quiesce(struct fixed_rsrc_data *data, flush_delayed_work(&ctx->rsrc_put_work);

ret = wait_for_completion_interruptible(&data->done); - if (!ret) + if (!ret || !io_refs_resurrect(&data->refs, &data->done)) break;

- percpu_ref_resurrect(&data->refs); io_sqe_rsrc_set_node(ctx, data, backup_node); backup_node = NULL; - reinit_completion(&data->done); mutex_unlock(&ctx->uring_lock); ret = io_run_task_work_sig(); mutex_lock(&ctx->uring_lock);