[PATCH 1/1] io_uring: fix mixed cqe overflow handling

[PATCH 1/1] io_uring: fix mixed cqe overflow handling

[Pavel Begunkov]

I started to see zcrx data corruptions. That turned out to be due
to CQ tail pointing to a stale entry which happened to be from
a zcrx request. I.e. the tail is incremented without the CQE
memory being changed.

The culprit is __io_cqring_overflow_flush() passing "cqe32=true"
to io_get_cqe_overflow() for non-mixed CQE32 setups, which only
expects it to be set for mixed 32B CQEs and not for SETUP_CQE32.

The fix is slightly hacky, long term it's better to unify mixed and
CQE32 handling.

Fixes: e26dca67fde19 ("io_uring: add support for IORING_SETUP_CQE_MIXED")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/io_uring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 1e58fc1d5667..5d130c578435 100644
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -601,6 +601,8 @@ static void __io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool dying)
 			is_cqe32 = true;
 			cqe_size <<= 1;
 		}
+		if (ctx->flags & IORING_SETUP_CQE32)
+			is_cqe32 = false;
 
 		if (!dying) {
 			if (!io_get_cqe_overflow(ctx, &cqe, true, is_cqe32))
-- 
2.52.0

Re: [PATCH 1/1] io_uring: fix mixed cqe overflow handling

[Jens Axboe]

On Tue, 25 Nov 2025 12:33:06 +0000, Pavel Begunkov wrote:
> I started to see zcrx data corruptions. That turned out to be due
> to CQ tail pointing to a stale entry which happened to be from
> a zcrx request. I.e. the tail is incremented without the CQE
> memory being changed.
> 
> The culprit is __io_cqring_overflow_flush() passing "cqe32=true"
> to io_get_cqe_overflow() for non-mixed CQE32 setups, which only
> expects it to be set for mixed 32B CQEs and not for SETUP_CQE32.
> 
> [...]

Applied, thanks!

[1/1] io_uring: fix mixed cqe overflow handling
      commit: f6dc5a36195d3f5be769f60d6987150192dfb099

Best regards,
-- 
Jens Axboe