io_uring: recycle provided buffer if we punt to io-wq

io_arm_poll_handler() will recycle the buffer appropriately if we end
up arming poll (or if we're ready to retry), but not for the io-wq case
if we have attempted poll first.

Explicitly recycle the buffer to avoid both hanging on to it too long,
but also to avoid multiple reads grabbing the same one. This can happen
for ring mapped buffers, since it hasn't necessarily been committed.

Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Link: https://github.com/axboe/liburing/issues/605
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 95a1a78d799a17a69b0f6aca651580e2fd34e6c2..d3ee4fc532fafc8601e20b53f059c6f8bf620ede 100644 (file)
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -8690,6 +8690,7 @@ static void io_queue_async(struct io_kiocb *req, int ret)
                 * Queued up for async execution, worker will release
                 * submit reference when the iocb is actually submitted.
                 */
+               io_kbuf_recycle(req, 0);
                io_queue_iowq(req, NULL);
                break;
        case IO_APOLL_OK: