io_uring/net: ensure expanded bundle send gets marked for cleanup

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: a05d1f625c7a ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/net.c b/io_uring/net.c
index 97a48408cec39b2e821fd051fb28ba67e5e7fc6f..050bea5e72569b6890cddadd0007efeb52b18bdd 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -623,6 +623,7 @@ retry_bundle:
                if (arg.iovs != &kmsg->fast_iov && arg.iovs != kmsg->free_iov) {
                        kmsg->free_iov_nr = ret;
                        kmsg->free_iov = arg.iovs;
+                       req->flags |= REQ_F_NEED_CLEANUP;
                }
        }