io_uring/zcrx: fix overshooting recv limit

09cfd3c5 · Pavel Begunkov <[email protected]> · 2025-10-08 13:38:06 +01:00

It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.

Reported-and-tested-by: Matthias Jasny <[email protected]>
Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests")
Cc: [email protected]
Signed-off-by: Pavel Begunkov <[email protected]>
Signed-off-by: Jens Axboe <[email protected]>

Commit: 09cfd3c52ea76f43b3cb15e570aeddf633d65e80
Parents: beb97995

Changes

1 files changed · +4 −0

File	Status	Add	Del	Content
io_uring/zcrx.c	modified	+4	−0	View file

io_uring/zcrx.c

View file

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 723e426..ef73440 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1236,12 +1236,16 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
 
 		end = start + frag_iter->len;
 		if (offset < end) {
+			size_t count;
+
 			copy = end - offset;
 			if (copy > len)
 				copy = len;
 
 			off = offset - start;
+			count = desc->count;
 			ret = io_zcrx_recv_skb(desc, frag_iter, off, copy);
+			desc->count = count;
 			if (ret < 0)
 				goto out;
 