[PATCH liburing] fix io_uring_recvmsg_cmsg_nexthdr logic

[Dylan Yudaken <dylany@fb.com>]

io_uring_recvmsg_cmsg_nexthdr was using the payload to delineate the end
of the cmsg list, but really it needs to use whatever was returned by the
kernel.

Reported-by: Jens Axboe <axboe@kernel.dk>
Fixes: 874406f ("add multishot recvmsg API")
Signed-off-by: Dylan Yudaken <dylany@fb.com>
---
 src/include/liburing.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/include/liburing.h b/src/include/liburing.h
index 583b917..fc7613d 100644
--- a/src/include/liburing.h
+++ b/src/include/liburing.h
@@ -745,7 +745,8 @@ io_uring_recvmsg_cmsg_nexthdr(struct io_uring_recvmsg_out *o, struct msghdr *m,
 
 	if (cmsg->cmsg_len < sizeof(struct cmsghdr))
 		return NULL;
-	end = (unsigned char *) io_uring_recvmsg_payload(o, m);
+	end = (unsigned char *) io_uring_recvmsg_cmsg_firsthdr(o, m) +
+		o->controllen;
 	cmsg = (struct cmsghdr *)((unsigned char *) cmsg +
 			CMSG_ALIGN(cmsg->cmsg_len));
 
-- 
2.30.2