[PATCH] io_uring/kbuf: don't early commit provided ring buffers if locked

[Jens Axboe <axboe@kernel.dk>]

If multiple buffers are peeked, they need not get committed upfront if
the caller has the uring_lock held - for that case, rely on the caller
recycling or committing before dropping the lock. This can happen if the
operation fails and needs to punt to polling, for example.

Link: https://github.com/axboe/liburing/discussions/1528
Cc: stable@vger.kernel.org
Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 796d131107dd..427e80748580 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -328,14 +328,15 @@ int io_buffers_select(struct io_kiocb *req, struct buf_sel_arg *arg,
 	if (sel->buf_list->flags & IOBL_BUF_RING) {
 		ret = io_ring_buffers_peek(req, arg, sel->buf_list);
 		/*
-		 * Don't recycle these buffers if we need to go through poll.
-		 * Nobody else can use them anyway, and holding on to provided
-		 * buffers for a send/write operation would happen on the app
-		 * side anyway with normal buffers. Besides, we already
-		 * committed them, they cannot be put back in the queue.
+		 * Allow recyling of these buffers only if we arrived here
+		 * in a locked state. That relies on the caller doing the
+		 * proper recycling under the lock, if it doesn't commit under
+		 * the lock.
 		 */
 		if (ret > 0) {
-			req->flags |= REQ_F_BUFFERS_COMMIT | REQ_F_BL_NO_RECYCLE;
+			req->flags |= REQ_F_BUFFERS_COMMIT;
+			if (issue_flags & IO_URING_F_UNLOCKED)
+				req->flags |= REQ_F_BL_NO_RECYCLE;
 			io_kbuf_commit(req, sel->buf_list, arg->out_len, ret);
 		}
 	} else {

-- 
Jens Axboe