6.18-stable patches

added patches:
	io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch
	io_uring-wait-fix-min_timeout-behavior.patch

diff --git a/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch b/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch
new file mode 100644 (file)
index 0000000..b88d1e2
--- /dev/null
+++ b/queue-6.18/io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch
@@ -0,0 +1,43 @@
+From b01e74c189cc3e17fbb98f28f69245b259144429 Mon Sep 17 00:00:00 2001
+From: Jens Axboe <axboe@kernel.dk>
+Date: Sun, 7 Jun 2026 16:05:47 -0600
+Subject: io_uring/kbuf: don't truncate end buffer for bundles
+
+From: Jens Axboe <axboe@kernel.dk>
+
+Commit 70f4886bcbb929e88038c8807f1daf7fc587ae7c upstream.
+
+If buffers have been peeked for a bundle receive, the kernel will
+truncate the end buffer, if the available length is shorter than the
+buffer itself. This is unnecessary, as applications iterating bundle
+receives must always use the minimum size of the buffer length and the
+remaining number of bytes in the bundle. The examples in liburing do
+that as well, eg examples/proxy.c.
+
+If the kernel does truncate this buffer AND the current transfer fails,
+then the buffer will be left with a smaller size than what is otherwise
+available.
+
+Just remove the buffer truncation, as it's not necessary in the first
+place.
+
+Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/
+Reported-by: Federico Brasili <federico.brasili@gmail.com>
+Cc: stable@vger.kernel.org
+Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers")
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/kbuf.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/io_uring/kbuf.c
++++ b/io_uring/kbuf.c
+@@ -305,7 +305,6 @@ static int io_ring_buffers_peek(struct i
+                               arg->partial_map = 1;
+                               if (iov != arg->iovs)
+                                       break;
+-                              buf->len = len;
+                       }
+               }
+ 

diff --git a/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch b/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch
new file mode 100644 (file)
index 0000000..9522019
--- /dev/null
+++ b/queue-6.18/io_uring-wait-fix-min_timeout-behavior.patch
@@ -0,0 +1,37 @@
+From f3bdf56a5b1677153d7ff38e0a2a69c87bc50f7c Mon Sep 17 00:00:00 2001
+From: "Christian A. Ehrhardt" <lk@c--e.de>
+Date: Sat, 6 Jun 2026 22:11:20 +0200
+Subject: io_uring/wait: fix min_timeout behavior
+
+From: "Christian A. Ehrhardt" <lk@c--e.de>
+
+Commit 29fe1bd01b99714f3136f922230a643c2742cda9 upstream.
+
+The wakeup condition if a min timeout is present and has expired is that
+at least _one_ CQE was posted. Thus set the cq_tail target to
+->cq_min_tail + 1. Without this commit a spurious wakeup can result in a
+premature wakeup because io_should_wake() will return true even if _no_
+CQE was posted at all.
+
+Cc: Tip ten Brink <tip@tenbrinkmeijs.com>
+Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL")
+Cc: stable@vger.kernel.org
+Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
+Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de
+Signed-off-by: Jens Axboe <axboe@kernel.dk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ io_uring/io_uring.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/io_uring/io_uring.c
++++ b/io_uring/io_uring.c
+@@ -2586,7 +2586,7 @@ static enum hrtimer_restart io_cqring_mi
+       }
+ 
+       /* any generated CQE posted past this time should wake us up */
+-      iowq->cq_tail = iowq->cq_min_tail;
++      iowq->cq_tail = iowq->cq_min_tail + 1;
+ 
+       hrtimer_update_function(&iowq->t, io_cqring_timer_wakeup);
+       hrtimer_set_expires(timer, iowq->timeout);

diff --git a/queue-6.18/series b/queue-6.18/series
index 7d0afba7dc56dcdcacad320dccb2e5d569e2c337..31b7fc97092e491c760dc15820558c9242da8cfc 100644 (file)
--- a/queue-6.18/series
+++ b/queue-6.18/series
@@ -244,3 +244,5 @@ nvmem-core-fix-use-after-free-bugs-in-error-paths.patch
 nvmem-layouts-onie-tlv-fix-hang-on-unknown-types.patch
 octeontx2-af-fix-memory-leak-in-rvu_setup_hw_resources.patch
 pinctrl-mcp23s08-read-spi-present-mask-as-u8-not-u32.patch
+io_uring-kbuf-don-t-truncate-end-buffer-for-bundles.patch
+io_uring-wait-fix-min_timeout-behavior.patch