···793793794794 for (i = 0; i < table->nr; ++i) {795795 struct kioctx *ctx = table->table[i];796796+ struct completion requests_done =797797+ COMPLETION_INITIALIZER_ONSTACK(requests_done);796798797799 if (!ctx)798800 continue;···806804 * that it needs to unmap the area, just set it to 0.807805 */808806 ctx->mmap_size = 0;809809- kill_ioctx(mm, ctx, NULL);807807+ kill_ioctx(mm, ctx, &requests_done);808808+809809+ /* Wait until all IO for the context are done. */810810+ wait_for_completion(&requests_done);810811 }811812812813 RCU_INIT_POINTER(mm->ioctx_table, NULL);···11151110 head = ring->head;11161111 tail = ring->tail;11171112 kunmap_atomic(ring);11131113+11141114+ /*11151115+ * Ensure that once we've read the current tail pointer, that11161116+ * we also see the events that were stored up to the tail.11171117+ */11181118+ smp_rmb();1118111911191120 pr_debug("h%u t%u m%u\n", head, tail, ctx->nr_events);11201121