It's reported that sometimes a zcrx request can receive more than was requested. It's caused by io_zcrx_recv_skb() adjusting desc->count for all received buffers including frag lists, but then doing recursive calls to process frag list skbs, which leads to desc->count double accounting and underflow.
Unified · Split
| @@ -1236,12 +1236,16 @@ io_zcrx_recv_skb(read_descriptor_t *desc, struct sk_buff *skb, · 1235 unmodified lines | |||
| 1236 | 1236 | ||
| 1237 | end = start + frag_iter->len; | 1237 | end = start + frag_iter->len; |
| 1238 | if (offset < end) { | 1238 | if (offset < end) { |
| 1239 | size_t count; | ||
| 1240 | |||
| 1239 | copy = end - offset; | 1241 | copy = end - offset; |
| 1240 | if (copy > len) | 1242 | if (copy > len) |
| 1241 | copy = len; | 1243 | copy = len; |
| 1242 | 1244 | ||
| 1243 | off = offset - start; | 1245 | off = offset - start; |
| 1246 | count = desc->count; | ||
| 1244 | ret = io_zcrx_recv_skb(desc, frag_iter, off, copy); | 1247 | ret = io_zcrx_recv_skb(desc, frag_iter, off, copy); |
| 1248 | desc->count = count; | ||
| 1245 | if (ret < 0) | 1249 | if (ret < 0) |
| 1246 | goto out; | 1250 | goto out; |
| 1247 | 1251 | ||