aio: take final put_ioctx() into callers of io_destroy()

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/aio.c b/fs/aio.c
index fe37a94127e78c7c6a9a33619978a6c0875274bb..da887604dfc51929cd4cc17b10a943645b4618ef 100644 (file)
--- a/fs/aio.c
+++ b/fs/aio.c
@@ -1270,7 +1270,6 @@ static void io_destroy(struct kioctx *ioctx)
         * locking done by the above calls to ensure this consistency.
         */
        wake_up_all(&ioctx->wait);
-       put_ioctx(ioctx);       /* once for the lookup */
 }
 
 /* sys_io_setup:
@@ -1307,11 +1306,9 @@ SYSCALL_DEFINE2(io_setup, unsigned, nr_events, aio_context_t __user *, ctxp)
        ret = PTR_ERR(ioctx);
        if (!IS_ERR(ioctx)) {
                ret = put_user(ioctx->user_id, ctxp);
-               if (!ret) {
-                       put_ioctx(ioctx);
-                       return 0;
-               }
-               io_destroy(ioctx);
+               if (ret)
+                       io_destroy(ioctx);
+               put_ioctx(ioctx);
        }
 
 out:
@@ -1329,6 +1326,7 @@ SYSCALL_DEFINE1(io_destroy, aio_context_t, ctx)
        struct kioctx *ioctx = lookup_ioctx(ctx);
        if (likely(NULL != ioctx)) {
                io_destroy(ioctx);
+               put_ioctx(ioctx);
                return 0;
        }
        pr_debug("EINVAL: io_destroy: invalid context id\n");