If multiple buffers are peeked, they need not get committed upfront if
the caller has the uring_lock held - for that case, rely on the caller
recycling or committing before dropping the lock. This can happen if the
operation fails and needs to punt to polling, for example.

Link: https://github.com/axboe/liburing/discussions/1528
Cc: stable@vger.kernel.org
Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
Signed-off-by: Jens Axboe <axboe@kernel.dk>

---

v2: forgot to refresh patch, the commit needs to be under the
    IO_URING_F_UNLOCKED section too of course.

diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c
index 796d131107dd..27c190c5bb5f 100644
--- a/io_uring/kbuf.c
+++ b/io_uring/kbuf.c
@@ -328,15 +328,17 @@ int io_buffers_select(struct io_kiocb *req, struct buf_sel_arg *arg,
 	if (sel->buf_list->flags & IOBL_BUF_RING) {
 		ret = io_ring_buffers_peek(req, arg, sel->buf_list);
 		/*
-		 * Don't recycle these buffers if we need to go through poll.
-		 * Nobody else can use them anyway, and holding on to provided
-		 * buffers for a send/write operation would happen on the app
-		 * side anyway with normal buffers. Besides, we already
-		 * committed them, they cannot be put back in the queue.
+		 * Allow recyling of these buffers only if we arrived here
+		 * in a locked state. That relies on the caller doing the
+		 * proper recycling under the lock, if it doesn't commit under
+		 * the lock.
 		 */
 		if (ret > 0) {
-			req->flags |= REQ_F_BUFFERS_COMMIT | REQ_F_BL_NO_RECYCLE;
-			io_kbuf_commit(req, sel->buf_list, arg->out_len, ret);
+			req->flags |= REQ_F_BUFFERS_COMMIT;
+			if (issue_flags & IO_URING_F_UNLOCKED) {
+				req->flags |= REQ_F_BL_NO_RECYCLE;
+				io_kbuf_commit(req, sel->buf_list, arg->out_len, ret);
+			}
 		}
 	} else {
 		ret = io_provided_buffers_select(req, &arg->out_len, sel->buf_list, arg->iovs);

-- 
Jens Axboe