[PATCH] io_uring/net: fix multishot recv length limit accounting

[PATCH] io_uring/net: fix multishot recv length limit accounting

[Cheng Yongkang]

io_recv_finish() debits sr->mshot_total_len with min_t(int, sel->val,
sr->mshot_total_len).  sel->val is the cumulative byte count of the
request: on a bundle retry the receive path adds sr->done_io back to the
return value, and the bundle branch in io_recv_finish() recovers the new
bytes with this_ret = sel->val - sr->done_io.  The debit therefore uses
the wrong value after a bundle retry, and the int cast truncates a limit
above INT_MAX.

For an IORING_OP_RECV multishot request with optlen above INT_MAX, the
limit becomes negative when cast to int, so the first completion debits
the entire limit and ends the multishot with IORING_RECV_MSHOT_DONE
while the socket still holds data that covers the limit.  With 120 bytes
queued, a 64-byte buffer and optlen 0x80000000, the first 64-byte CQE
lacks IORING_CQE_F_MORE and 56 bytes remain unread; the same setup with
optlen 0x7fffffff posts 64 and 56 bytes with F_MORE.

After a bundle retry, the bytes already debited for the previous
attempts are debited again, so the limit is exhausted early.  With 1400
bytes queued, optlen 1000 and buffers of 600, 100, 100, 50, 50 and 200
bytes, the first attempt delivers 700 bytes and retries; the second
delivers 200 more, but the debit accounts for 900 and finishes the
request with a terminal 900-byte CQE while 500 bytes remain unread.  The
limit could have been reached.

Debit only the bytes received by this invocation, sel->val - sr->done_io,
and compare as unsigned so a limit above INT_MAX is accounted correctly.
Non-bundle multishot requests keep sr->done_io at zero, so their
accounting is unchanged.

Fixes: 0ebc9a7ecf6a ("io_uring/net: Support multishot receive len cap")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Cheng Yongkang <teel4res@gmail.com>
---
 io_uring/net.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index 66e637a..79af1f1 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -881,12 +881,15 @@ static inline bool io_recv_finish(struct io_kiocb *req,
 		cflags |= IORING_CQE_F_SOCK_NONEMPTY;
 
 	if (sel->val > 0 && sr->flags & IORING_RECV_MSHOT_LIM) {
+		unsigned int this_len = sel->val - sr->done_io;
+
 		/*
 		 * If sr->len hits zero, the limit has been reached. Mark
 		 * mshot as finished, and flag MSHOT_DONE as well to prevent
 		 * a potential bundle from being retried.
 		 */
-		sr->mshot_total_len -= min_t(int, sel->val, sr->mshot_total_len);
+		sr->mshot_total_len -= min_t(unsigned int, this_len,
+					     sr->mshot_total_len);
 		if (!sr->mshot_total_len) {
 			sr->flags |= IORING_RECV_MSHOT_DONE;
 			mshot_finished = true;
-- 
2.34.1

Re: [PATCH] io_uring/net: fix multishot recv length limit accounting

[Jens Axboe]

On Thu, 29 Oct 2026 07:12:20 -0700, Cheng Yongkang wrote:
> io_recv_finish() debits sr->mshot_total_len with min_t(int, sel->val,
> sr->mshot_total_len).  sel->val is the cumulative byte count of the
> request: on a bundle retry the receive path adds sr->done_io back to the
> return value, and the bundle branch in io_recv_finish() recovers the new
> bytes with this_ret = sel->val - sr->done_io.  The debit therefore uses
> the wrong value after a bundle retry, and the int cast truncates a limit
> above INT_MAX.
> 
> [...]

Applied, thanks!

[1/1] io_uring/net: fix multishot recv length limit accounting
      commit: 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c

Best regards,
-- 
Jens Axboe