From 8742f4b5a472c347fe568a73468a2d9e4d630b33 Mon Sep 17 00:00:00 2001 From: Yichong Chen Date: Fri, 23 Oct 2026 17:17:11 +0800 Subject: [PATCH] io_uring/kbuf: advance head when a pickup empties the buffer ring io_ring_buffers_peek() flags the request with REQ_F_BL_EMPTY if the buffers it picked were the last ones available, comparing head to tail. When the loop breaks because max_len was exhausted the buffer was picked, but head is left pointing at it, so the flag isn't set if it was the last buffer. A bundle receive then retries, finds no buffer, and the request, which has received data, is marked as failed on account of the -ENOBUFS. That severs a link, and ends a multishot. Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Yichong Chen Link: https://patch.msgid.link/20261023091711.83481-1-chenyichong@uniontech.com Signed-off-by: Jens Axboe --- io_uring/kbuf.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index c9641b6ccc8f..abf44f5dba26 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -326,8 +326,10 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, arg->out_len += len; arg->max_len -= len; - if (!arg->max_len) + if (!arg->max_len) { + head++; break; + } buf = io_ring_head_to_buf(br, ++head, bl->mask); } while (--nr_iovs);