io_uring/net: ensure expanded bundle recv gets marked for cleanup

commit 11893e144ed75be55d99349760513ca104781fc0 upstream.

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: 2f9c9515bdfd ("io_uring/net: support bundles for recv")
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/net.c b/io_uring/net.c
index cf742bdd2a93e5f2f87e5c141bb0e135fcb04d3c..39dbf6cd07af2821248c7994f15597f8805edbb9 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1084,6 +1084,7 @@ static int io_recv_buf_select(struct io_kiocb *req, struct io_async_msghdr *kmsg
                if (arg.iovs != &kmsg->fast_iov && arg.iovs != kmsg->free_iov) {
                        kmsg->free_iov_nr = ret;
                        kmsg->free_iov = arg.iovs;
+                       req->flags |= REQ_F_NEED_CLEANUP;
                }
        } else {
                void __user *buf;