io_uring: re-set iov base/len for buffer select retry

commit dddb3e26f6d88c5344d28cb5ff9d3d6fa05c4f7a upstream.

We already have the buffer selected, but we should set the iter list
again.

Cc: stable@vger.kernel.org # v5.7
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 8cdf8ca373132e15e07d01b07ca6c1112c079df6..6883104323bdf4b808689c840218589280bf24ac 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -2333,8 +2333,14 @@ static ssize_t __io_iov_buffer_select(struct io_kiocb *req, struct iovec *iov,
 static ssize_t io_iov_buffer_select(struct io_kiocb *req, struct iovec *iov,
                                    bool needs_lock)
 {
-       if (req->flags & REQ_F_BUFFER_SELECTED)
+       if (req->flags & REQ_F_BUFFER_SELECTED) {
+               struct io_buffer *kbuf;
+
+               kbuf = (struct io_buffer *) (unsigned long) req->rw.addr;
+               iov[0].iov_base = u64_to_user_ptr(kbuf->addr);
+               iov[0].iov_len = kbuf->len;
                return 0;
+       }
        if (!req->rw.len)
                return 0;
        else if (req->rw.len > 1)