diff options
| author |   Pavel Begunkov <asml.silence@gmail.com> | 2025-10-08 13:38:06 +0100 |
|---|---|---|
| committer |   Jens Axboe <axboe@kernel.dk> | 2025-10-08 07:26:08 -0600 |
| commit | 09cfd3c52ea76f43b3cb15e570aeddf633d65e80 (patch) | |
| tree | 1b88c8144d720d4c351e690a3b2d15ba72c3ae91 /drivers/usb | |
| parent | io_uring: use tab indentation for IORING_SEND_VECTORIZED comment (diff) | |
| download | linux-rng-09cfd3c52ea76f43b3cb15e570aeddf633d65e80.tar.xz linux-rng-09cfd3c52ea76f43b3cb15e570aeddf633d65e80.zip | |
io_uring/zcrx: fix overshooting recv limit
It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.
Reported-and-tested-by: Matthias Jasny <matthiasjasny@gmail.com>
Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Diffstat (limited to 'drivers/usb')
0 files changed, 0 insertions, 0 deletions