Re: [PATCH 2/2] io_uring/net: don't overconsume buffers when using MSG_TRUNC

[Jens Axboe <axboe@kernel.dk>]

> When a recv/recvmsg is issued with MSG_TRUNC and the incoming packet is
> larger than the provided buffer, the net layer returns the full length
> of the packet rather than the number of bytes actually copied into the
> buffer.  As a result, io_uring advances more of the provided buffer ring
> than was actually filled.  Use the actual filled region size to consume
> the buffer, but still return the full size to preserve MSG_TRUNC
> semantics.
>
> Take care with multishot, because that seems to already truncate the
> consumption based on the available payload size.
>
> This was reported in https://github.com/axboe/liburing/issues/1619.
>
> Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption")
> Cc: stable@vger.kernel.org
> Link: https://patch.msgid.link/20260728191454.1850326-1-krisman@suse.de
> Signed-off-by: Gabriel Krisman Bertazi <krisman@suse.de>
> ---
>  io_uring/net.c | 38 +++++++++++++++++++++++++++++++-------
>  1 file changed, 31 insertions(+), 7 deletions(-)
>
> diff --git a/io_uring/net.c b/io_uring/net.c
> index 647156c9331a..f8110dc9f860 100644
> --- a/io_uring/net.c
> +++ b/io_uring/net.c
> @@ -853,7 +853,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
>  static inline bool io_recv_finish(struct io_kiocb *req,
>                                   struct io_async_msghdr *kmsg,
>                                   struct io_br_sel *sel, bool mshot_finished,
> -                                 unsigned issue_flags)
> +                                 unsigned issue_flags, size_t consumed)
>  {

Not sure this is correct. If consumed is a size_t, then the comparison
between ret > len is an unsigned comparison, and every error will then
get clamped?

Will need something like this folded in.

diff --git a/io_uring/net.c b/io_uring/net.c
index f8110dc9f860..0ca43a24f1a5 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -853,7 +853,7 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 static inline bool io_recv_finish(struct io_kiocb *req,
 				  struct io_async_msghdr *kmsg,
 				  struct io_br_sel *sel, bool mshot_finished,
-				  unsigned issue_flags, size_t consumed)
+				  unsigned issue_flags, int consumed)
 {
 	struct io_sr_msg *sr = io_kiocb_to_cmd(req, struct io_sr_msg);
 	unsigned int cflags = 0;
@@ -1027,7 +1027,8 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags)
 	int ret, min_ret = 0;
 	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
 	bool mshot_finished = true;
-	size_t len, consumed = 0;
+	int consumed = 0;
+	size_t len;
 
 	sock = sock_from_file(req->file);
 	if (unlikely(!sock))
@@ -1080,8 +1081,8 @@ int io_recvmsg(struct io_kiocb *req, unsigned int issue_flags)
 		 * buffer.
 		 */
 		consumed = ret;
-		if (ret > len)
-			consumed = len;
+		if (ret > 0)
+			consumed = min_t(size_t, ret, len);
 	}
 
 	if (ret < min_ret) {
@@ -1195,10 +1196,11 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 	struct io_br_sel sel;
 	struct socket *sock;
 	unsigned flags;
-	int ret, min_ret = 0;
-	size_t consumed = 0, len = 0;
+	int ret, min_ret = 0, consumed = 0;
+	int consumed = 0;
 	bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
 	bool mshot_finished;
+	size_t len = 0;
 
 	sock = sock_from_file(req->file);
 	if (unlikely(!sock))
@@ -1273,8 +1275,8 @@ int io_recv(struct io_kiocb *req, unsigned int issue_flags)
 	 * buffer.
 	 */
 	consumed = ret;
-	if (ret > len)
-		consumed = len;
+	if (ret > 0)
+		consumed = min_t(size_t, ret, len);
 
 	if (ret > 0)
 		ret += sr->done_io;

-- 
Jens Axboe