It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.
Unified · Split
| @@ -1236,12 +1236,16 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb, · 1235 unmodified lines | ||
| 1236 | 1236 | |
| 1237 | 1237 | end = start + frag_iter->len; |
| 1238 | 1238 | if (offset < end) { |
| 1239 | + size_t count; | |
| 1240 | + | |
| 1239 | 1241 | copy = end - offset; |
| 1240 | 1242 | if (copy > len) |
| 1241 | 1243 | copy = len; |
| 1242 | 1244 | |
| 1243 | 1245 | off = offset - start; |
| 1246 | + count = desc->count; | |
| 1244 | 1247 | ret = io_zcrx_recv_skb(desc, frag_iter, off, copy); |
| 1248 | + desc->count = count; | |
| 1245 | 1249 | if (ret < 0) |
| 1246 | 1250 | goto out; |
| 1247 | 1251 | |