io_uring/net: ensure expanded bundle send gets marked for cleanup

commit 70ed519ed59da3a92c3acedeb84a30e5a66051ce upstream.

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: a05d1f625c7a ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/net.c b/io_uring/net.c
index 39dbf6cd07af2821248c7994f15597f8805edbb9..d1d69288e2c8dd128302dc526047817506ff96e8 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -613,6 +613,7 @@ retry_bundle:
                if (arg.iovs != &kmsg->fast_iov && arg.iovs != kmsg->free_iov) {
                        kmsg->free_iov_nr = ret;
                        kmsg->free_iov = arg.iovs;
+                       req->flags |= REQ_F_NEED_CLEANUP;
                }
        }