diff options
| author | Jens Axboe <axboe@kernel.dk> | 2025-06-20 07:41:21 -0600 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2025-06-20 08:33:45 -0600 |
| commit | 51a4598ad5d9eb6be4ec9ba65bbfdf0ac302eb2e (patch) | |
| tree | 57c9f0fad20d5e6979844e4f01c531b9c9467520 /io_uring/net.c | |
| parent | e1c75831f682eef0f68b35723437146ed86070b1 (diff) | |
io_uring/net: always use current transfer count for buffer put
A previous fix corrected the retry condition for when to continue a
current bundle, but it missed that the current (not the total) transfer
count also applies to the buffer put. If not, then for incrementally
consumed buffer rings repeated completions on the same request may end
up over consuming.
Reported-by: Roy Tang (ErgoniaTrading) <royonia@ergonia.io>
Cc: stable@vger.kernel.org
Fixes: 3a08988123c8 ("io_uring/net: only retry recv bundle for a full transfer")
Link: https://github.com/axboe/liburing/issues/1423
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring/net.c')
| -rw-r--r-- | io_uring/net.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/io_uring/net.c b/io_uring/net.c index e16633fd6630..9550d4c8f866 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -821,7 +821,7 @@ static inline bool io_recv_finish(struct io_kiocb *req, int *ret, if (sr->flags & IORING_RECVSEND_BUNDLE) { size_t this_ret = *ret - sr->done_io; - cflags |= io_put_kbufs(req, *ret, io_bundle_nbufs(kmsg, this_ret), + cflags |= io_put_kbufs(req, this_ret, io_bundle_nbufs(kmsg, this_ret), issue_flags); if (sr->retry) cflags = req->cqe.flags | (cflags & CQE_F_MASK); |