io_complete_rw_iopoll() updates cqe.res when the transfer does not match the requested length, but it does not call req_set_fail(). Soft linked requests then still run after a short or failed IOPOLL read or write. Fixes: b66ceaf324b3 ("io_uring: move iopoll reissue into regular IO path") Signed-off-by: Yang Xiuwei --- io_uring/rw.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/io_uring/rw.c b/io_uring/rw.c index 3a8559ff4dc6..cf20597ba6a8 100644 --- a/io_uring/rw.c +++ b/io_uring/rw.c @@ -606,8 +606,10 @@ static void io_complete_rw_iopoll(struct kiocb *kiocb, long res) if (res == -EAGAIN && io_rw_should_reissue(req)) req->flags |= REQ_F_REISSUE | REQ_F_BL_NO_RECYCLE; - else if (unlikely(final_res != req->cqe.res)) + else if (unlikely(final_res != req->cqe.res)) { + req_set_fail(req); req->cqe.res = final_res; + } /* order with io_iopoll_complete() checking ->iopoll_completed */ smp_store_release(&req->iopoll_completed, 1); -- 2.25.1