When io_req_defer alloc memory fails, it will be -EAGAIN. But io_submit_sqe cannot return immediately because the reference count for req is still held. Ensure that we free it.

[axboe@kernel.dk: reword commit message] Fixes: de0617e46717 ("io_uring: add support for marking commands as draining") Cc: stable@vger.kernel.org # 5.2 Signed-off-by: Jackie Liu liuyun01@kylinos.cn --- fs/io_uring.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/fs/io_uring.c b/fs/io_uring.c index 4ef62a45045d..1c388533cdc8 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -1843,8 +1843,8 @@ static int io_submit_sqe(struct io_ring_ctx *ctx, struct sqe_submit *s, ret = io_req_defer(ctx, req, s->sqe); if (ret) { if (ret == -EIOCBQUEUED) - ret = 0; - return ret; + return 0; + goto out; }

ret = __io_submit_sqe(ctx, req, s, true);