--- /dev/null
+From 1b6b46b344561c9b5127bcc59c68a310d66f4368 Mon Sep 17 00:00:00 2001
+From: Pavel Begunkov <asml.silence@gmail.com>
+Date: Mon, 20 Mar 2023 07:05:02 -0600
+Subject: io_uring/msg_ring: let target know allocated index
+
+From: Pavel Begunkov <asml.silence@gmail.com>
+
+commit 5da28edd7bd5518f97175ecea77615bb729a7a28 upstream.
+
+msg_ring requests transferring files support auto index selection via
+IORING_FILE_INDEX_ALLOC, however they don't return the selected index
+to the target ring and there is no other good way for the userspace to
+know where is the receieved file.
+
+Return the index for allocated slots and 0 otherwise, which is
+consistent with other fixed file installing requests.
+
+Cc: stable@vger.kernel.org # v6.0+
+Fixes: e6130eba8a848 ("io_uring: add support for passing fixed file descriptors")
+Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
+Link: https://github.com/axboe/liburing/issues/809
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/msg_ring.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/io_uring/msg_ring.c
++++ b/io_uring/msg_ring.c
+@@ -84,6 +84,8 @@ static int io_msg_send_fd(struct io_kioc
+ struct file *src_file;
+ int ret;
+
++ if (msg->len)
++ return -EINVAL;
+ if (target_ctx == ctx)
+ return -EINVAL;
+ if (target_ctx->flags & IORING_SETUP_R_DISABLED)
+@@ -120,7 +122,7 @@ static int io_msg_send_fd(struct io_kioc
+ * completes with -EOVERFLOW, then the sender must ensure that a
+ * later IORING_OP_MSG_RING delivers the message.
+ */
+- if (!io_post_aux_cqe(target_ctx, msg->user_data, msg->len, 0, true))
++ if (!io_post_aux_cqe(target_ctx, msg->user_data, ret, 0, true))
+ ret = -EOVERFLOW;
+ out_unlock:
+ io_double_unlock_ctx(ctx, target_ctx, issue_flags);