Patch "io_uring: fix return value when removing provided buffers" has been added to the 6.2-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    io_uring: fix return value when removing provided buffers

to the 6.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     io_uring-fix-return-value-when-removing-provided-buf.patch
and it can be found in the queue-6.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 1178eb563633769ee3789faceb33d3c9254fb859
Author: Wojciech Lukowicz <wlukowicz01@xxxxxxxxx>
Date:   Sat Apr 1 20:50:38 2023 +0100

    io_uring: fix return value when removing provided buffers
    
    [ Upstream commit c0921e51dab767ef5adf6175c4a0ba3c6e1074a3 ]
    
    When a request to remove buffers is submitted, and the given number to be
    removed is larger than available in the specified buffer group, the
    resulting CQE result will be the number of removed buffers + 1, which is
    1 more than it should be.
    
    Previously, the head was part of the list and it got removed after the
    loop, so the increment was needed. Now, the head is not an element of
    the list, so the increment shouldn't be there anymore.
    
    Fixes: dbc7d452e7cf ("io_uring: manage provided buffers strictly ordered")
    Signed-off-by: Wojciech Lukowicz <wlukowicz01@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230401195039.404909-2-wlukowicz01@xxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 3002dc8271959..0fdcc0adbdbcc 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -228,7 +228,6 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
 		return i;
 	}
 
-	/* the head kbuf is the list itself */
 	while (!list_empty(&bl->buf_list)) {
 		struct io_buffer *nxt;
 
@@ -238,7 +237,6 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx,
 			return i;
 		cond_resched();
 	}
-	i++;
 
 	return i;
 }