We do io_kbuf_recycle() when arming a poll but every iteration of a
multishot can grab more buffers, which is why we need to flush the kbuf
ring state before continuing with waiting.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: b3fdea6ecb55c ("io_uring: multishot recv")
Reported-by: Muhammad Ramdhan <ramdhan@xxxxxxxxxxx>
Reported-by: Bing-Jhong Billy Jheng <billy@xxxxxxxxxxx>
Reported-by: Jacob Soo <jacob.soo@xxxxxxxxxxx>
Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx>
---
io_uring/poll.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/io_uring/poll.c b/io_uring/poll.c
index cc01c40b43d31..f12a857bb8555 100644
--- a/io_uring/poll.c
+++ b/io_uring/poll.c
@@ -315,8 +315,10 @@ void io_poll_task_func(struct io_kiocb *req, struct io_tw_state *ts)
ret = io_poll_check_events(req, ts);
if (ret == IOU_POLL_NO_ACTION) {
+ io_kbuf_recycle(req, 0);
return;
} else if (ret == IOU_POLL_REQUEUE) {
+ io_kbuf_recycle(req, 0);
__io_poll_execute(req, 0);
return;
}
--
2.47.1
