Re: [PATCH] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT

[Jens Axboe]

On Fri, 23 Oct 2026 19:22:09 +0800, Yichong Chen wrote:
> io_recvmsg() takes the transfer length from the ring provided buffer when
> sqe->len is 0, and such a buffer can be up to 4G. min_ret is an int, so 2G
> or more makes it negative and the (ret < min_ret) block is skipped, and the
> oversized length reaches the socket layer unchanged: an empty socket then
> completes with 0 instead of arming poll, and a short read is reported as
> complete. Clamp the length to MAX_RW_COUNT, as io_recv() does.
> 
> [...]

Applied, thanks!

[1/1] io_uring/net: keep recvmsg buffer select length within MAX_RW_COUNT
      commit: 18d3f56eb6e6500a65d81cf265f0fe74fd9ecab6

Best regards,
-- 
Jens Axboe