Re: [PATCH] io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries

On 6/4/26 10:07 AM, Cl?ment L?ger wrote:
> When a bundle recv retries inside io_recv_finish(), the merge logic
> OR the saved cflags from the previous iteration with the cflags
> returned by the new iteration:
>   cflags = req->cqe.flags | (cflags & CQE_F_MASK);
> 
> Bits listed in CQE_F_MASK are inherited from the new iteration, and
> all other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come
> from the saved cflags. Before this change CQE_F_MASK covered only
> IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE.
> 
> When using provided buffer rings (IOU_PBUF_RING_INC) with incremental
> mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring
> entry partially consumed, __io_put_kbufs() then sets
> IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the
> buffer ID will be reused for subsequent completions.
> 
> Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above
> silently dropped it whenever the final retry iteration partially consumed
> the buffer, and the subsequent req->cqe.flags = cflags & ~CQE_F_MASK
> save would have left a stale IORING_CQE_F_BUF_MORE in the carried-over
> cflags had one been present. Userspace would then wrongfully advance it
> ring head past an entry the kernel still uses.
> 
> Add IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from
> the new iteration into the user-visible CQE and stripped from the
> saved cflags between iterations.

Looks good!

> A test available in
> https://github.com/clementleger/liburing/tree/bug_f_buf_more allows to
> validate this fix.

Can you send in the test case separately for liburing?

> 
> Signed-off-by: Cl?ment L?ger <[email protected]>
> Assisted-by: Claude:claude-opus-4.6

I'll add a:

Cc: [email protected]
Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption")

-- 
Jens Axboe