When doing a multishot read, the code path reuses the old read
paths. However this breaks an assumption built into those paths,
namely that struct io_rw::len is available for reuse by __io_import_iovec.
For multishot this results in len being set for the first receive
call, and then subsequent calls are clamped to that buffer length incorrectly.
Fixes: fc68fcda0491 ("io_uring/rw: add support for IORING_OP_READ_MULTISHOT")
Signed-off-by: Dylan Yudaken <dyudaken@xxxxxxxxx>
---
io_uring/rw.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/io_uring/rw.c b/io_uring/rw.c
index ea86498d8769..b7f7fbc28032 100644
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -417,6 +417,8 @@ static struct iovec *__io_import_iovec(int ddir, struct io_kiocb *req,
if (!io_issue_defs[opcode].vectored || req->flags & REQ_F_BUFFER_SELECT) {
if (io_do_buffer_select(req)) {
+ if (opcode == IORING_OP_READ_MULTISHOT)
+ sqe_len = 0;
buf = io_buffer_select(req, &sqe_len, issue_flags);
if (!buf)
return ERR_PTR(-ENOBUFS);
--
2.41.0
