[PATCH] io_uring/kbuf: advance head when a pickup empties the buffer ring

[PATCH] io_uring/kbuf: advance head when a pickup empties the buffer ring

[Yichong Chen]

io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
buffers it picked were the last ones available, comparing head to tail.
When the loop breaks because max_len was exhausted the buffer was picked,
but head is left pointing at it, so the flag isn't set if it was the last
buffer. A bundle receive then retries, finds no buffer, and the request,
which has received data, is marked as failed on account of the -ENOBUFS.
That severs a link, and ends a multishot.

Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
---
 io_uring/kbuf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index c9641b6ccc8f..abf44f5dba26 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
 
 		arg->out_len += len;
 		arg->max_len -= len;
-		if (!arg->max_len)
+		if (!arg->max_len) {
+			head++;
 			break;
+		}
 
 		buf = io_ring_head_to_buf(br, ++head, bl->mask);
 	} while (--nr_iovs);
-- 
2.51.0

Re: [PATCH] io_uring/kbuf: advance head when a pickup empties the buffer ring

[Gabriel Krisman Bertazi]

Yichong Chen <chenyichong@uniontech.com> writes:

> io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
> buffers it picked were the last ones available, comparing head to tail.
> When the loop breaks because max_len was exhausted the buffer was picked,
> but head is left pointing at it, so the flag isn't set if it was the last
> buffer. A bundle receive then retries, finds no buffer, and the request,
> which has received data, is marked as failed on account of the -ENOBUFS.
> That severs a link, and ends a multishot.
>
> Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
> Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
> ---
>  io_uring/kbuf.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
> index c9641b6ccc8f..abf44f5dba26 100644
> --- a/io_uring/kbuf.c
> +++ b/io_uring/kbuf.c
> @@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
>  
>  		arg->out_len += len;
>  		arg->max_len -= len;
> -		if (!arg->max_len)
> +		if (!arg->max_len) {
> +			head++;
>  			break;
> +		}
>  
>  		buf = io_ring_head_to_buf(br, ++head, bl->mask);

Reviewed-by: Gabriel Krisman Bertazi <krisman@suse.de>


>  	} while (--nr_iovs);
> -- 
> 2.51.0
>

-- 
Gabriel Krisman Bertazi