btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

If all bios finish before btrfs_encoded_read_regular_fill_pages()
returns, it calls btrfs_uring_read_extent_endio() and previously
returned the I/O status.  A negative errno then made
btrfs_uring_read_extent() unlock and free while
btrfs_uring_read_finished() did the same again.

Return -EIOCBQUEUED so only the deferred path cleans up.

Reported-by: Yue Sun <samsun1006219@gmail.com>
Closes: https://lore.kernel.org/linux-btrfs/20260630091609.3414-1-samsun1006219@gmail.com/
Suggested-by: Jens Axboe <axboe@kernel.dk>
Fixes: 34310c442e17 ("btrfs: add io_uring command for encoded reads (ENCODED_READ ioctl)")
Signed-off-by: Yang Xiuwei <yangxiuwei@kylinos.cn>
Signed-off-by: David Sterba <dsterba@suse.com>

diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 53f4532593b36cc1d6bc346023528b607c1eda92..32c4dbcd3a4c8697b7c3c88fe8896678e4850681 100644 (file)
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9631,7 +9631,6 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
        struct completion sync_reads;
        unsigned long i = 0;
        struct btrfs_bio *bbio;
-       int ret;
 
        /*
         * Fast path for synchronous reads which completes in this call, io_uring
@@ -9678,10 +9677,10 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
 
        if (uring_ctx) {
                if (refcount_dec_and_test(&priv->pending_refs)) {
-                       ret = blk_status_to_errno(READ_ONCE(priv->status));
-                       btrfs_uring_read_extent_endio(uring_ctx, ret);
+                       int err = blk_status_to_errno(READ_ONCE(priv->status));
+
+                       btrfs_uring_read_extent_endio(uring_ctx, err);
                        kfree(priv);
-                       return ret;
                }
 
                return -EIOCBQUEUED;