From: Pavel Begunkov <asml.silence@xxxxxxxxx> When we get -EIOCBQUEUED, we need to ensure that the buffer is consumed from the provided buffer ring, which can be done with io_kbuf_recycle() + REQ_F_PARTIAL_IO. Reported-by: Muhammad Ramdhan <ramdhan@xxxxxxxxxxx> Reported-by: Bing-Jhong Billy Jheng <billy@xxxxxxxxxxx> Reported-by: Jacob Soo <jacob.soo@xxxxxxxxxxx> Fixes: c7fb19428d67d ("io_uring: add support for ring mapped supplied buffers") Signed-off-by: Pavel Begunkov <asml.silence@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- io_uring/rw.c | 10 ++++++++++ 1 file changed, 10 insertions(+) --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -772,6 +772,8 @@ static int __io_read(struct io_kiocb *re goto done; ret = 0; } else if (ret == -EIOCBQUEUED) { + req->flags |= REQ_F_PARTIAL_IO; + io_kbuf_recycle(req, issue_flags); if (iovec) kfree(iovec); return IOU_ISSUE_SKIP_COMPLETE; @@ -795,6 +797,9 @@ static int __io_read(struct io_kiocb *re goto done; } + req->flags |= REQ_F_PARTIAL_IO; + io_kbuf_recycle(req, issue_flags); + io = req->async_data; s = &io->s; /* @@ -935,6 +940,11 @@ int io_write(struct io_kiocb *req, unsig else ret2 = -EINVAL; + if (ret2 == -EIOCBQUEUED) { + req->flags |= REQ_F_PARTIAL_IO; + io_kbuf_recycle(req, issue_flags); + } + if (req->flags & REQ_F_REISSUE) { req->flags &= ~REQ_F_REISSUE; ret2 = -EAGAIN; Patches currently in stable-queue which might be from asml.silence@xxxxxxxxx are queue-6.1/io_uring-fix-multishots-with-selected-buffers.patch queue-6.1/io_uring-fix-io_req_prep_async-with-provided-buffers.patch queue-6.1/io_uring-rw-commit-provided-buffer-state-on-async.patch