Merge tag 'io_uring-6.15-20250522' of git://git.kernel.dk/linux

Pull io_uring fixes from Jens Axboe:

 - Kill a duplicate function definition, which can cause linking issues
   in certain .config configurations. Introduced in this cycle.

 - Fix for a potential overflow CQE reordering issue if a re-schedule is
   done during posting. Heading to stable.

 - Fix for an issue with recv bundles, where certain conditions can lead
   to gaps in the buffers, where a contiguous buffer range was expected.
   Heading to stable.

* tag 'io_uring-6.15-20250522' of git://git.kernel.dk/linux:
  io_uring/net: only retry recv bundle for a full transfer
  io_uring: fix overflow resched cqe reordering
  io_uring/cmd: axe duplicate io_uring_cmd_import_fixed_vec() declaration

1 files changed, 10 insertions, 4 deletions

diff --git a/io_uring/net.c b/io_uring/net.c
index 24040bc3916a..27f37fa2ef79 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -827,18 +827,24 @@ static inline bool io_recv_finish(struct io_kiocb *req, int *ret,
 		cflags |= IORING_CQE_F_SOCK_NONEMPTY;
 
 	if (sr->flags & IORING_RECVSEND_BUNDLE) {
-		cflags |= io_put_kbufs(req, *ret, io_bundle_nbufs(kmsg, *ret),
+		size_t this_ret = *ret - sr->done_io;
+
+		cflags |= io_put_kbufs(req, *ret, io_bundle_nbufs(kmsg, this_ret),
 				      issue_flags);
 		if (sr->retry)
 			cflags = req->cqe.flags | (cflags & CQE_F_MASK);
 		/* bundle with no more immediate buffers, we're done */
 		if (req->flags & REQ_F_BL_EMPTY)
 			goto finish;
-		/* if more is available, retry and append to this one */
-		if (!sr->retry && kmsg->msg.msg_inq > 0 && *ret > 0) {
+		/*
+		 * If more is available AND it was a full transfer, retry and
+		 * append to this one
+		 */
+		if (!sr->retry && kmsg->msg.msg_inq > 0 && this_ret > 0 &&
+		    !iov_iter_count(&kmsg->msg.msg_iter)) {
 			req->cqe.flags = cflags & ~CQE_F_MASK;
 			sr->len = kmsg->msg.msg_inq;
-			sr->done_io += *ret;
+			sr->done_io += this_ret;
 			sr->retry = true;
 			return false;
 		}