diff options
| author | Yichong Chen <chenyichong@uniontech.com> | 2026-10-23 19:22:09 +0800 |
|---|---|---|
| committer | Jens Axboe <axboe@kernel.dk> | 2026-10-26 12:11:41 -0600 |
| commit | 18d3f56eb6e6500a65d81cf265f0fe74fd9ecab6 (patch) | |
| tree | 9116e2d540fa6a7bd6d080d1dbbb9e0b0f36c971 /io_uring | |
| parent | 8742f4b5a472c347fe568a73468a2d9e4d630b33 (diff) | |
io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
io_recvmsg() takes the transfer length from the ring provided buffer when
sqe->len is 0, and such a buffer can be up to 4G. min_ret is an int, so 2G
or more makes it negative and the (ret < min_ret) block is skipped, and the
oversized length reaches the socket layer unchanged: an empty socket then
completes with 0 instead of arming poll, and a short read is reported as
complete. Clamp the length to MAX_RW_COUNT, as io_recv() does.
Fixes: c7fb19428d67 ("io_uring: add support for ring mapped supplied buffers")
Signed-off-by: Yichong Chen <chenyichong@uniontech.com>
Link: https://patch.msgid.link/20261023112209.87979-1-chenyichong@uniontech.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'io_uring')
| -rw-r--r-- | io_uring/net.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/io_uring/net.c b/io_uring/net.c index eeab88e77fd8..4678f29f5177 100644 --- a/io_uring/net.c +++ b/io_uring/net.c @@ -1068,6 +1068,7 @@ retry_multishot: sel = io_buffer_select(req, &len, sr->buf_group, issue_flags); if (!sel.addr) return -ENOBUFS; + len = min_t(size_t, len, MAX_RW_COUNT); if (req->flags & REQ_F_APOLL_MULTISHOT) { ret = io_recvmsg_prep_multishot(kmsg, sr, &sel.addr, &len); |