From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A052D313552 for ; Sun, 7 Jun 2026 21:23:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780867386; cv=none; b=tXkO0w6HXv95U8nUOby4ljT8rEv2FXlls4EfnHe6D2JNf54pD9SnNcFavGZJfyBUT26nXk3F2RUkkWx9SGDEnfeAHWjLwhJ4kVgGfov6aUIF+RuWBpGVQdAtdjYqY626p/XOTiASKGXitAKJUKOmccph25HLWJKy10LOMk3GEpA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780867386; c=relaxed/simple; bh=EEq5qvhA49r12mr+gMOEoD/0WfBAlttJQu44IQmu5X8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=crwJ9HVyQVeec3gXenEirnVwkN3IgM5U5Wrs1yAxjqKRJg2JrrkHqR6lqw4FvumDs7msXIvfTbVZt7KDPahwY1Dvmp05ui71JAn5pOGgUf8y8z7GZb12nQlDHGkcdXePpxxOaGKD3uizIsj3qxiAyN9BIUrhGMeLwDdvECn4eNo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=gTrZ9dNw; arc=none smtp.client-ip=209.85.221.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="gTrZ9dNw" Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-45efa80e0afso2804156f8f.2 for ; Sun, 07 Jun 2026 14:23:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780867383; x=1781472183; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=xDTJqgjzotVu57/W16f4O0oCW/R4B2iNnJZk0eAPd8o=; b=gTrZ9dNwk//ZhNeEyj8uaIZDMk/dkN7yNzzEynzrKNRj2v38I4A+faBa1KeHpOQK9k KbnHgaRQPsAp1rTb3B30+AxAoPASxPk9Kvgy/YhZnDejRJDLG1kRJQ9sx7p8/7vrR0G0 TeZF500x95jYczIoK64fNqIhRCKrYkYjrSkPrxJC2ZqZAKEBeLa+dx3lxZrBHb+yT9Ik OH1i5ZGtOf0fixtYs0uaoAjhL4OnJJ7RWynkte5KR4zBANhLhEfsJmDAOWGFikjZ6ev6 JUKcV00JsKHxt2wftpJwASeZvl9+ut1HJZEwMN0nN1H2/56Z/QfajiwOzFFKy9rQPjs/ u4JQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780867383; x=1781472183; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=xDTJqgjzotVu57/W16f4O0oCW/R4B2iNnJZk0eAPd8o=; b=ll8+EuA2L0RHgPRPbYVSw45Ff/qpAzWZF55MvgG0LvobnMhSiyhrq+FgbbjCNx98cV fMH0YEzDPcxIXkQ84qgfrrHPOn4eppL8TB7BSuXfpkAs+dHYsdCd+/v93w09H8YbHoTm VNxIpuJT2HKp2NZx4ahrRh0Shj5voF7v9Yys815yqHimElYhAcor6MZqSYebEoh+JI0I zBeEjkCQtLrCscxec4/ylIjHajzd+BkQ6UPlOWMvgYLoZpvm2fNxBdaB7UXsJDtCu0Nl QuZpoI09IvmbGiXqhvPLzyPlWyDyRJk6v7nDu4JC38XiZ0BZ3pw1Lfid1hpYfL8pikAs OHWA== X-Forwarded-Encrypted: i=1; AFNElJ8MdQfZVD0OsbF3zqldT8DjsbcNNtlmYminN343AZaDKjDFRnCabFlqrRtW1+vgyTP+RXyZIZd4Wjz2eS0=@vger.kernel.org X-Gm-Message-State: AOJu0YzjhsVD2ZKBzksN75R2M9lwgNJlatSSfkhtnTQHolspDBnaZk6w 27SG5lIEviZIquZaiKNE9cN8M7j/ob/O9odQ97ENE8WmlJ5WV+DpjV81 X-Gm-Gg: Acq92OFRCc8aIsKIISQh0PImYqH6sGKtSdrl66QhpdYWVP0HhT92nfAzxUc7cxF6Au4 ctJ6GAHosOiyJa9IiS8M1/YvqCuVSSVPq3qhk+IpBoF1X0Lm+tZyRVLQ6ck/gpPJzGysvB9sqvX fXLkN9RdqQP9tgpQ024gUbd3NIkADHZFnrSTyeCvIJ/crlRsV2z0jDXTR6kLf5M24Aozv9/CcDF Z2IBU1XvF+EPCR+tTSoAOWcLYi3GXDAOWVt1zqlwBewvPqtq1tTqGTRTOFoh7Tqpa2ikuLt3jFi eu14Rz3FyWid5fmWmalGrw7L6WR4AwyUGvJ7h1cUgHADpo5SfehTC3+nuKiGVGvZXaiVQ+YSxdm 718SfX3B2ShWUitOqG0H1c4fA5RyflDySFn44CG7N5npnRs7YKwzsCfGfOx1NtqW4W1fyQhogWN Bekn6ruDFW3qsqOs1lc28EVfi+IszjDZU6kqC4o3bU X-Received: by 2002:a5d:6190:0:b0:45e:ec18:f20a with SMTP id ffacd0b85a97d-46030759730mr13984648f8f.32.1780867382776; Sun, 07 Jun 2026 14:23:02 -0700 (PDT) Received: from localhost ([217.199.144.50]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-4601f35fb24sm48890167f8f.34.2026.06.07.14.23.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 07 Jun 2026 14:23:02 -0700 (PDT) From: Nyakundi Emmanuel To: federico.brasili@gmail.com Cc: axboe@kernel.dk, io-uring@vger.kernel.org, linux-kernel@vger.kernel.org, Nyakundi Emmanuel Subject: Re: [BUG io_uring] Failed RECVSEND_BUNDLE can persistently shrink non-INC pbuf ring len and affect later READ operations Date: Mon, 8 Jun 2026 00:22:18 +0300 Message-ID: X-Mailer: git-send-email 2.54.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Sun, 7 Jun 2026, Federico Brasili wrote: > I found a reproducible io_uring provided-buffer ring issue on Ubuntu > kernel 7.0.0-22-generic. > > A failed IORING_RECVSEND_BUNDLE receive on a non-INC provided-buffer > ring can persistently shrink the user-visible buffer descriptor length. Confirmed reproducible on: Linux archlinux 7.0.11-arch1-1 #1 SMP PREEMPT_DYNAMIC Tue, 02 Jun 2026 18:26:58 +0000 x86_64 Arch Linux (rolling) Output from your reproducer, run unprivileged: [INIT] entry0 len=4096 bid=0 entry1 len=4096 bid=1 tail=2 [STEP1] poison empty socket: BUNDLE len=1 expect -EAGAIN but entry0 len may truncate [CQE1] res=-11 flags=0x0 user=0x1111 [AFTER1] entry0 len=1 entry1 len=4096 tail=2 changed_buf0=0 changed_buf1=0 guard_before=0 guard_after=0 [STEP2] wrote pipe bytes=4096, now IORING_OP_READ len=4096 after recv-BUNDLE poisoning [CQE_READ] res=1 flags=0x1 user=0x6666 [AFTER_READ] entry0 len=1 entry1 len=4096 tail=2 changed_buf0=1 changed_buf1=0 guard_before=0 guard_after=0 [STEP3] wrote second pipe chunk bytes=4096, second IORING_OP_READ len=4096 without republish [CQE_READ2] res=4096 flags=0x10001 user=0x7777 [AFTER_READ2] entry0 len=1 entry1 len=4096 tail=2 changed_buf0=1 changed_buf1=4096 guard_before=0 guard_after=0 entry0.len persistently corrupted 4096 -> 1 after -EAGAIN RECV_BUNDLE. Subsequent IORING_OP_READ consumed the poisoned length as reported. This confirms the issue is not Ubuntu-specific and reproduces on a stock upstream-tracking kernel. Nyakundi Emmanuel