Re: [PATCH] io_uring/kbuf: advance head when a pickup empties the buffer ring

[Gabriel Krisman Bertazi]

Yichong Chen <chenyichong@xxxxxxxxxxxxx> writes:

> io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
> buffers it picked were the last ones available, comparing head to tail.
> When the loop breaks because max_len was exhausted the buffer was picked,
> but head is left pointing at it, so the flag isn't set if it was the last
> buffer. A bundle receive then retries, finds no buffer, and the request,
> which has received data, is marked as failed on account of the -ENOBUFS.
> That severs a link, and ends a multishot.
>
> Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
> Signed-off-by: Yichong Chen <chenyichong@xxxxxxxxxxxxx>
> ---
>  io_uring/kbuf.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
> index c9641b6ccc8f..abf44f5dba26 100644
> --- a/io_uring/kbuf.c
> +++ b/io_uring/kbuf.c
> @@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
>  
>  		arg->out_len += len;
>  		arg->max_len -= len;
> -		if (!arg->max_len)
> +		if (!arg->max_len) {
> +			head++;
>  			break;
> +		}
>  
>  		buf = io_ring_head_to_buf(br, ++head, bl->mask);

Reviewed-by: Gabriel Krisman Bertazi <krisman@xxxxxxx>


>  	} while (--nr_iovs);
> -- 
> 2.51.0
>

-- 
Gabriel Krisman Bertazi