io_uring/kbuf: advance head when a pickup empties the buffer ring

io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the
buffers it picked were the last ones available, comparing head to tail.
When the loop breaks because max_len was exhausted the buffer was picked,
but head is left pointing at it, so the flag isn't set if it was the last
buffer. A bundle receive then retries, finds no buffer, and the request,
which has received data, is marked as failed on account of the -ENOBUFS.
That severs a link, and ends a multishot.

Fixes: 35c8711c8f ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023091711.83481-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Yichong Chen 2026-10-23 17:17:11 +08:00 committed by Jens Axboe
parent 6b4b543fa1
commit 8742f4b5a4

View File

@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg,
arg->out_len += len;
arg->max_len -= len;
if (!arg->max_len)
if (!arg->max_len) {
head++;
break;
}
buf = io_ring_head_to_buf(br, ++head, bl->mask);
} while (--nr_iovs);