io_uring/rw: fix cflags posting for single issue multishot read

If multishot gets disabled, and hence the request will get terminated
rather than persist for more iterations, then posting the CQE with the
right cflags is still important. Most notably, the buffer reference
needs to be included.

Refactor the return of __io_read() a bit, so that the provided buffer
is always put correctly, and hence returned to the application.

Reported-by: Sharon Rosner <Sharon Rosner>
Link: https://github.com/axboe/liburing/issues/1257
Cc: stable@vger.kernel.org
Fixes: 2a975d426c82 ("io_uring/rw: don't allow multishot reads without NOWAIT support")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/rw.c b/io_uring/rw.c
index f023ff49c6883cbe00aab4979e7c2fd115e5cad2..93ad926058844e617c438d10cf9a6ec45eea1945 100644 (file)
--- a/io_uring/rw.c
+++ b/io_uring/rw.c
@@ -972,17 +972,21 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags)
                if (issue_flags & IO_URING_F_MULTISHOT)
                        return IOU_ISSUE_SKIP_COMPLETE;
                return -EAGAIN;
-       }
-
-       /*
-        * Any successful return value will keep the multishot read armed.
-        */
-       if (ret > 0 && req->flags & REQ_F_APOLL_MULTISHOT) {
+       } else if (ret <= 0) {
+               io_kbuf_recycle(req, issue_flags);
+               if (ret < 0)
+                       req_set_fail(req);
+       } else {
                /*
-                * Put our buffer and post a CQE. If we fail to post a CQE, then
+                * Any successful return value will keep the multishot read
+                * armed, if it's still set. Put our buffer and post a CQE. If
+                * we fail to post a CQE, or multishot is no longer set, then
                 * jump to the termination path. This request is then done.
                 */
                cflags = io_put_kbuf(req, ret, issue_flags);
+               if (!(req->flags & REQ_F_APOLL_MULTISHOT))
+                       goto done;
+
                rw->len = 0; /* similarly to above, reset len to 0 */
 
                if (io_req_post_cqe(req, ret, cflags | IORING_CQE_F_MORE)) {
@@ -1003,6 +1007,7 @@ int io_read_mshot(struct io_kiocb *req, unsigned int issue_flags)
         * Either an error, or we've hit overflow posting the CQE. For any
         * multishot request, hitting overflow will terminate it.
         */
+done:
        io_req_set_res(req, ret, cflags);
        io_req_rw_cleanup(req, issue_flags);
        if (issue_flags & IO_URING_F_MULTISHOT)