From 70f4886bcbb929e88038c8807f1daf7fc587ae7c Mon Sep 17 00:00:00 2001 From: Jens Axboe Date: Sun, 7 Jun 2026 16:05:47 -0600 Subject: [PATCH 1/2] io_uring/kbuf: don't truncate end buffer for bundles If buffers have been peeked for a bundle receive, the kernel will truncate the end buffer, if the available length is shorter than the buffer itself. This is unnecessary, as applications iterating bundle receives must always use the minimum size of the buffer length and the remaining number of bytes in the bundle. The examples in liburing do that as well, eg examples/proxy.c. If the kernel does truncate this buffer AND the current transfer fails, then the buffer will be left with a smaller size than what is otherwise available. Just remove the buffer truncation, as it's not necessary in the first place. Link: https://lore.kernel.org/io-uring/CAAEr8jbY60noGj1fw_k91UJRBkyiRVoS6=nLhZ7Svwidjn4CAA@mail.gmail.com/ Reported-by: Federico Brasili Cc: stable@vger.kernel.org Fixes: 35c8711c8fc4 ("io_uring/kbuf: add helpers for getting/peeking multiple buffers") Signed-off-by: Jens Axboe --- io_uring/kbuf.c | 1 - 1 file changed, 1 deletion(-) diff --git a/io_uring/kbuf.c b/io_uring/kbuf.c index 63061aa1cab9..926254b6898f 100644 --- a/io_uring/kbuf.c +++ b/io_uring/kbuf.c @@ -305,7 +305,6 @@ static int io_ring_buffers_peek(struct io_kiocb *req, struct buf_sel_arg *arg, arg->partial_map = 1; if (iov != arg->iovs) break; - WRITE_ONCE(buf->len, len); } } From 29fe1bd01b99714f3136f922230a643c2742cda9 Mon Sep 17 00:00:00 2001 From: "Christian A. Ehrhardt" Date: Sat, 6 Jun 2026 22:11:20 +0200 Subject: [PATCH 2/2] io_uring/wait: fix min_timeout behavior The wakeup condition if a min timeout is present and has expired is that at least _one_ CQE was posted. Thus set the cq_tail target to ->cq_min_tail + 1. Without this commit a spurious wakeup can result in a premature wakeup because io_should_wake() will return true even if _no_ CQE was posted at all. Cc: Tip ten Brink Fixes: e15cb2200b93 ("io_uring: fix min_wait wakeups for SQPOLL") Cc: stable@vger.kernel.org Signed-off-by: Christian A. Ehrhardt Link: https://patch.msgid.link/20260606201120.1441447-1-lk@c--e.de Signed-off-by: Jens Axboe --- io_uring/wait.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/io_uring/wait.c b/io_uring/wait.c index ec01e78a216d..d005ea17b35f 100644 --- a/io_uring/wait.c +++ b/io_uring/wait.c @@ -103,7 +103,7 @@ static enum hrtimer_restart io_cqring_min_timer_wakeup(struct hrtimer *timer) } /* any generated CQE posted past this time should wake us up */ - iowq->cq_tail = iowq->cq_min_tail; + iowq->cq_tail = iowq->cq_min_tail + 1; hrtimer_update_function(&iowq->t, io_cqring_timer_wakeup); hrtimer_set_expires(timer, iowq->timeout);