Re: [PATCH 2/2] io_uring/net: don't overconsume buffers when using MSG_TRUNC

[Jens Axboe <axboe@kernel.dk>]

On 9/9/26 7:56 AM, Jens Axboe wrote:
>> When a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is
>> larger than the provided buffer, the net layer returns the full length
>> of the packet rather than the number of bytes actually copied into the
>> buffer.  As a result, io_uring advances more of the provided buffer ring
>> than was actually filled.  Use the actual filled region size to consume
>> the buffer, but still return the full size to preserve MSG_TRUNC
>> semantics.
>>
>> Take care with multishot, because that seems to already truncate the
>> consumption based on the available payload size.
>>
>> This was reported in https://github.com/axboe/liburing/issues/1619.
>>
>> Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption")
>> Cc: stable@vger.kernel.org
>> Link: https://patch.msgid.link/20260728191454.1850326-1-krisman@suse.de
>> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
>> ---
>>  io_uring/net.c | 38 +++++++++++++++++++++++++++++++-------
>>  1 file changed, 31 insertions(+), 7 deletions(-)
>>
>> diff --git a/io_uring/net.c b/io_uring/net.c
>> index 647156c9331a..f8110dc9f860 100644
>> --- a/io_uring/net.c
>> +++ b/io_uring/net.c
>> @@ -853,7 +853,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
>>  static inline bool io_recv_finish(struct io_kiocb *req,
>>                                   struct io_async_msghdr *kmsg,
>>                                   struct io_br_sel *sel, bool mshot_finished,
>> -                                 unsigned issue_flags)
>> +                                 unsigned issue_flags, size_t consumed)
>>  {
> 
> Not sure this is correct. If consumed is a size_t, then the comparison
> between ret > len is an unsigned comparison, and every error will then
> get clamped?
> 
> Will need something like this folded in.

Can you check the current io_uring-7.3 or for-next tree and see if it
still fixes the issue?

-- 
Jens Axboe