io_uring/zcrx: fix overshooting recv limit

It's reported that sometimes a zcrx request can receive more than was
requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for
all received buffers including frag lists, but then doing recursive
calls to process frag list skbs, which leads to desc->count double
accounting and underflow.

Reported-and-tested-by: Matthias Jasny <matthiasjasny@gmail.com>
Fixes: 6699ec9a23f85 ("io_uring/zcrx: add a read limit to recvzc requests")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 723e4266b91fd6c094c3539460f9df8ae2a4ed9f..ef73440b605a991743d19a146d2ec394bf51088e 100644 (file)
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -1236,12 +1236,16 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb,
 
                end = start + frag_iter->len;
                if (offset < end) {
+                       size_t count;
+
                        copy = end - offset;
                        if (copy > len)
                                copy = len;
 
                        off = offset - start;
+                       count = desc->count;
                        ret = io_zcrx_recv_skb(desc, frag_iter, off, copy);
+                       desc->count = count;
                        if (ret < 0)
                                goto out;