Commit ed46f39c47eb for kernel

commit ed46f39c47eb5530a9c161481a2080d3a869cfaf
Author: Clément Léger <cleger@meta.com>
Date:   Thu Jun 4 09:07:13 2026 -0700

    io_uring/net: inherit IORING_CQE_F_BUF_MORE across bundle recv retries

    When a bundle recv retries inside io_recv_finish(), the merge logic OR
    the saved cflags from the previous iteration with the cflags returned by
    the new iteration:
      cflags = req->cqe.flags | (cflags & CQE_F_MASK);

    Bits listed in CQE_F_MASK are inherited from the new iteration, and all
    other bits (notably IORING_CQE_F_BUFFER and the buffer ID) come from the
    saved cflags. Before this change CQE_F_MASK covered only
    IORING_CQE_F_SOCK_NONEMPTY and IORING_CQE_F_MORE.

    When using provided buffer rings (IOU_PBUF_RING_INC) with incremental
    mode, and bundle recv, io_kbuf_inc_commit() can leave the head ring
    entry partially consumed, __io_put_kbufs() then sets
    IORING_CQE_F_BUF_MORE on the returned cflags so userspace knows the
    buffer ID will be reused for subsequent completions.

    Because IORING_CQE_F_BUF_MORE was not in CQE_F_MASK, the merge above
    silently dropped it whenever the final retry iteration partially
    consumed the buffer, and the subsequent req->cqe.flags = cflags &
    ~CQE_F_MASK save would have left a stale IORING_CQE_F_BUF_MORE in the
    carried-over cflags had one been present. Userspace would then
    wrongfully advance it ring head past an entry the kernel still uses.

    Add IORING_CQE_F_BUF_MORE to CQE_F_MASK so it is both inherited from the
    new iteration into the user-visible CQE and stripped from the saved
    cflags between iterations.

    Cc: stable@vger.kernel.org
    Signed-off-by: Clément Léger <cleger@meta.com>
    Assisted-by: Claude:claude-opus-4.6
    Fixes: ae98dbf43d75 ("io_uring/kbuf: add support for incremental buffer consumption")
    Link: https://patch.msgid.link/20260604160715.2482972-1-cleger@meta.com
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/io_uring/net.c b/io_uring/net.c
index 8df15b639358..ee848eb65ec9 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -842,7 +842,8 @@ int io_recvmsg_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 }

 /* bits to clear in old and inherit in new cflags on bundle retry */
-#define CQE_F_MASK	(IORING_CQE_F_SOCK_NONEMPTY|IORING_CQE_F_MORE)
+#define CQE_F_MASK	(IORING_CQE_F_SOCK_NONEMPTY|IORING_CQE_F_MORE|\
+			 IORING_CQE_F_BUF_MORE)

 /*
  * Finishes io_recv and io_recvmsg.