[bug report] io_uring: ensure async punted read/write requests copy iovec

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Jens Axboe,

The patch f67676d160c6: "io_uring: ensure async punted read/write
requests copy iovec" from Dec 2, 2019, leads to the following static
checker warning:

	fs/io_uring.c:2919 io_req_defer()
	warn: inconsistent returns 'irq'.

fs/io_uring.c
  2891  static int io_req_defer(struct io_kiocb *req)
  2892  {
  2893          struct io_ring_ctx *ctx = req->ctx;
  2894          struct io_async_ctx *io;
  2895          int ret;
  2896  
  2897          /* Still need defer if there is pending req in defer list. */
  2898          if (!req_need_defer(req) && list_empty(&ctx->defer_list))
  2899                  return 0;
  2900  
  2901          io = kmalloc(sizeof(*io), GFP_KERNEL);
  2902          if (!io)
  2903                  return -EAGAIN;
  2904  
  2905          spin_lock_irq(&ctx->completion_lock);
  2906          if (!req_need_defer(req) && list_empty(&ctx->defer_list)) {
  2907                  spin_unlock_irq(&ctx->completion_lock);
  2908                  kfree(io);
  2909                  return 0;
  2910          }
  2911  
  2912          ret = io_req_defer_prep(req, io);
  2913          if (ret < 0)
  2914                  return ret;

We need to spin_unlock_irq(&ctx->completion_lock); before returning.
The question of if we need to kfree(io) is more complicated to me
because I'm not sure how kiocb->ki_complete gets called...

  2915  
  2916          trace_io_uring_defer(ctx, req, req->user_data);
  2917          list_add_tail(&req->list, &ctx->defer_list);
  2918          spin_unlock_irq(&ctx->completion_lock);
  2919          return -EIOCBQUEUED;
  2920  }

regards,
dan carpenter