io_uring/net: ensure expanded bundle send gets marked for cleanup

If the iovec inside the kmsg isn't already allocated AND one gets
expanded beyond the fixed size, then the request may not already have
been marked for cleanup. Ensure that it is.

Cc: stable@vger.kernel.org
Fixes: a05d1f625c7a ("io_uring/net: support bundles for send")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/net.c b/io_uring/net.c
index 97a4840..050bea5 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -623,6 +623,7 @@ retry_bundle:
                if (arg.iovs != &kmsg->fast_iov && arg.iovs != kmsg->free_iov) {
                        kmsg->free_iov_nr = ret;
                        kmsg->free_iov = arg.iovs;
+                       req->flags |= REQ_F_NEED_CLEANUP;
                }
        }