Re: [PATCH] io_uring/net: fix multishot recv length limit accounting

[Jens Axboe]

On Thu, 29 Oct 2026 07:12:20 -0700, Cheng Yongkang wrote:
> io_recv_finish() debits sr->mshot_total_len with min_t(int, sel->val,
> sr->mshot_total_len).  sel->val is the cumulative byte count of the
> request: on a bundle retry the receive path adds sr->done_io back to the
> return value, and the bundle branch in io_recv_finish() recovers the new
> bytes with this_ret = sel->val - sr->done_io.  The debit therefore uses
> the wrong value after a bundle retry, and the int cast truncates a limit
> above INT_MAX.
> 
> [...]

Applied, thanks!

[1/1] io_uring/net: fix multishot recv length limit accounting
      commit: 3e3aebb7570ccdde5cc49c9bfc8fd3a436b71b0c

Best regards,
-- 
Jens Axboe