[PATCH] io_uring/net: fix netmsg_cache iovec leak on BIND and CONNECT

BIND and CONNECT allocate struct io_async_msghdr from netmsg_cache via
io_msg_alloc_async(). When a prior SENDMSG left a heap-allocated iovec[]
in the cached header, REQ_F_NEED_CLEANUP is set. Neither opcode had a
cleanup handler, so io_clean_op() would kfree(async_data) without
freeing the iovec on prep failure or cancellation. io_bind() also
omitted io_req_msg_cleanup() on the issue success path,
unlike io_connect().

Add io_sendmsg_recvmsg_cleanup for both opcodes and recycle the async
header from io_bind() after issue, matching CONNECT.

Fixes: 7481fd93fa0a ("io_uring: Introduce IORING_OP_BIND")
Signed-off-by: Yang Xiuwei <[email protected]>
---
 io_uring/net.c   | 3 ++-
 io_uring/opdef.c | 6 ++++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index 8df15b639358..0382be472712 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1855,8 +1855,9 @@ int io_bind(struct io_kiocb *req, unsigned int issue_flags)
 	ret = __sys_bind_socket(sock, &io->addr, bind->addr_len);
 	if (ret < 0)
 		req_set_fail(req);
+	io_req_msg_cleanup(req, issue_flags);
 	io_req_set_res(req, ret, 0);
-	return 0;
+	return IOU_COMPLETE;
 }
 
 int io_listen_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
diff --git a/io_uring/opdef.c b/io_uring/opdef.c
index c3ef52b70811..3ee020701fc1 100644
--- a/io_uring/opdef.c
+++ b/io_uring/opdef.c
@@ -658,6 +658,9 @@ const struct io_cold_def io_cold_defs[] = {
 	},
 	[IORING_OP_CONNECT] = {
 		.name			= "CONNECT",
+#if defined(CONFIG_NET)
+		.cleanup		= io_sendmsg_recvmsg_cleanup,
+#endif
 	},
 	[IORING_OP_FALLOCATE] = {
 		.name			= "FALLOCATE",
@@ -816,6 +819,9 @@ const struct io_cold_def io_cold_defs[] = {
 	},
 	[IORING_OP_BIND] = {
 		.name			= "BIND",
+#if defined(CONFIG_NET)
+		.cleanup		= io_sendmsg_recvmsg_cleanup,
+#endif
 	},
 	[IORING_OP_LISTEN] = {
 		.name			= "LISTEN",
-- 
2.25.1