From: David Laight <david.laight.linux@gmail.com>

Since iov_len is 'unsigned long' it is possible that the cast
to 'int' will change the value of min_t(int, iov[nbufs].iov_len, ret).
Use a plain min() and change the loop bottom to while (ret > 0) so that
the compiler knows 'ret' is always positive.

Also change min_t(int, sel->val, sr->mshot_total_len) to a simple min()
since sel->val is also long and subject to possible trunctation.

It might be that other checks stop these being problems, but they are
picked up by some compile-time tests for min_t() truncating values.

Signed-off-by: David Laight <david.laight.linux@gmail.com>
---
 io_uring/net.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/io_uring/net.c b/io_uring/net.c
index a95cc9ca2a4d..5fcc3e9b094e 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -483,11 +483,11 @@ static int io_bundle_nbufs(struct io_async_msghdr *kmsg, int ret)
 	/* short transfer, count segments */
 	nbufs = 0;
 	do {
-		int this_len = min_t(int, iov[nbufs].iov_len, ret);
+		int this_len = min(iov[nbufs].iov_len, ret);
 
 		nbufs++;
 		ret -= this_len;
-	} while (ret);
+	} while (ret > 0);
 
 	return nbufs;
 }
@@ -853,7 +853,7 @@ static inline bool io_recv_finish(struct io_kiocb *req,
 		 * mshot as finished, and flag MSHOT_DONE as well to prevent
 		 * a potential bundle from being retried.
 		 */
-		sr->mshot_total_len -= min_t(int, sel->val, sr->mshot_total_len);
+		sr->mshot_total_len -= min(sel->val, sr->mshot_total_len);
 		if (!sr->mshot_total_len) {
 			sr->flags |= IORING_RECV_MSHOT_DONE;
 			mshot_finished = true;
-- 
2.39.5

On 11/19/25 3:41 PM, david.laight.linux@gmail.com wrote:
> From: David Laight <david.laight.linux@gmail.com>
> 
> Since iov_len is 'unsigned long' it is possible that the cast
> to 'int' will change the value of min_t(int, iov[nbufs].iov_len, ret).
> Use a plain min() and change the loop bottom to while (ret > 0) so that
> the compiler knows 'ret' is always positive.
> 
> Also change min_t(int, sel->val, sr->mshot_total_len) to a simple min()
> since sel->val is also long and subject to possible trunctation.
> 
> It might be that other checks stop these being problems, but they are
> picked up by some compile-time tests for min_t() truncating values.

Fails with clang-21:

io_uring/net.c:855:26: error: call to '__compiletime_assert_2006' declared with 'error' attribute: min(sel->val, sr->mshot_total_len) signedness error
  855 |                 sr->mshot_total_len -= min(sel->val, sr->mshot_total_len);
      |                                        ^
./include/linux/minmax.h:105:19: note: expanded from macro 'min'
  105 | #define min(x, y)       __careful_cmp(min, x, y)
      |                         ^
./include/linux/minmax.h:98:2: note: expanded from macro '__careful_cmp'
   98 |         __careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
      |         ^
./include/linux/minmax.h:93:2: note: expanded from macro '__careful_cmp_once'
   93 |         BUILD_BUG_ON_MSG(!__types_ok(ux, uy),           \
      |         ^
note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
././include/linux/compiler_types.h:590:2: note: expanded from macro '_compiletime_assert'
  590 |         __compiletime_assert(condition, msg, prefix, suffix)
      |         ^
././include/linux/compiler_types.h:583:4: note: expanded from macro '__compiletime_assert'
  583 |                         prefix ## suffix();                             \
      |                         ^
<scratch space>:319:1: note: expanded from here
  319 | __compiletime_assert_2006
      | ^

-- 
Jens Axboe

On Thu, 20 Nov 2025 07:48:58 -0700
Jens Axboe <axboe@kernel.dk> wrote:

> On 11/19/25 3:41 PM, david.laight.linux@gmail.com wrote:
> > From: David Laight <david.laight.linux@gmail.com>
> > 
> > Since iov_len is 'unsigned long' it is possible that the cast
> > to 'int' will change the value of min_t(int, iov[nbufs].iov_len, ret).
> > Use a plain min() and change the loop bottom to while (ret > 0) so that
> > the compiler knows 'ret' is always positive.
> > 
> > Also change min_t(int, sel->val, sr->mshot_total_len) to a simple min()
> > since sel->val is also long and subject to possible trunctation.
> > 
> > It might be that other checks stop these being problems, but they are
> > picked up by some compile-time tests for min_t() truncating values.  
> 
> Fails with clang-21:
> 
> io_uring/net.c:855:26: error: call to '__compiletime_assert_2006' declared with 'error' attribute: min(sel->val, sr->mshot_total_len) signedness error
>   855 |                 sr->mshot_total_len -= min(sel->val, sr->mshot_total_len);

I'll take a look, I normally use gcc but there must be something subtle going on.
Actually which architecture?
I only tested x86-64.

	David

>       |                                        ^
> ./include/linux/minmax.h:105:19: note: expanded from macro 'min'
>   105 | #define min(x, y)       __careful_cmp(min, x, y)
>       |                         ^
> ./include/linux/minmax.h:98:2: note: expanded from macro '__careful_cmp'
>    98 |         __careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
>       |         ^
> ./include/linux/minmax.h:93:2: note: expanded from macro '__careful_cmp_once'
>    93 |         BUILD_BUG_ON_MSG(!__types_ok(ux, uy),           \
>       |         ^
> note: (skipping 2 expansions in backtrace; use -fmacro-backtrace-limit=0 to see all)
> ././include/linux/compiler_types.h:590:2: note: expanded from macro '_compiletime_assert'
>   590 |         __compiletime_assert(condition, msg, prefix, suffix)
>       |         ^
> ././include/linux/compiler_types.h:583:4: note: expanded from macro '__compiletime_assert'
>   583 |                         prefix ## suffix();                             \
>       |                         ^
> <scratch space>:319:1: note: expanded from here
>   319 | __compiletime_assert_2006
>       | ^
>

On 11/20/25 8:48 AM, David Laight wrote:
> On Thu, 20 Nov 2025 07:48:58 -0700
> Jens Axboe <axboe@kernel.dk> wrote:
> 
>> On 11/19/25 3:41 PM, david.laight.linux@gmail.com wrote:
>>> From: David Laight <david.laight.linux@gmail.com>
>>>
>>> Since iov_len is 'unsigned long' it is possible that the cast
>>> to 'int' will change the value of min_t(int, iov[nbufs].iov_len, ret).
>>> Use a plain min() and change the loop bottom to while (ret > 0) so that
>>> the compiler knows 'ret' is always positive.
>>>
>>> Also change min_t(int, sel->val, sr->mshot_total_len) to a simple min()
>>> since sel->val is also long and subject to possible trunctation.
>>>
>>> It might be that other checks stop these being problems, but they are
>>> picked up by some compile-time tests for min_t() truncating values.  
>>
>> Fails with clang-21:
>>
>> io_uring/net.c:855:26: error: call to '__compiletime_assert_2006' declared with 'error' attribute: min(sel->val, sr->mshot_total_len) signedness error
>>   855 |                 sr->mshot_total_len -= min(sel->val, sr->mshot_total_len);
> 
> I'll take a look, I normally use gcc but there must be something
> subtle going on. Actually which architecture? I only tested x86-64.

This is x86-64.

-- 
Jens Axboe

On Thu, 20 Nov 2025 08:53:56 -0700
Jens Axboe <axboe@kernel.dk> wrote:

> On 11/20/25 8:48 AM, David Laight wrote:
> > On Thu, 20 Nov 2025 07:48:58 -0700
> > Jens Axboe <axboe@kernel.dk> wrote:
> >   
> >> On 11/19/25 3:41 PM, david.laight.linux@gmail.com wrote:  
> >>> From: David Laight <david.laight.linux@gmail.com>
> >>>
> >>> Since iov_len is 'unsigned long' it is possible that the cast
> >>> to 'int' will change the value of min_t(int, iov[nbufs].iov_len, ret).
> >>> Use a plain min() and change the loop bottom to while (ret > 0) so that
> >>> the compiler knows 'ret' is always positive.
> >>>
> >>> Also change min_t(int, sel->val, sr->mshot_total_len) to a simple min()
> >>> since sel->val is also long and subject to possible trunctation.
> >>>
> >>> It might be that other checks stop these being problems, but they are
> >>> picked up by some compile-time tests for min_t() truncating values.    
> >>
> >> Fails with clang-21:
> >>
> >> io_uring/net.c:855:26: error: call to '__compiletime_assert_2006' declared with 'error' attribute: min(sel->val, sr->mshot_total_len) signedness error
> >>   855 |                 sr->mshot_total_len -= min(sel->val, sr->mshot_total_len);  
> > 
> > I'll take a look, I normally use gcc but there must be something
> > subtle going on. Actually which architecture? I only tested x86-64.  
> 
> This is x86-64.
> 

It is related to the test a few lines higher:
	if (sel->val > 0 && sr->flags & IORING_RECV_MSHOT_LIM) {
'sel->val' is ssize_t, gcc is tracking that test so statically_true(sel->val >= 0)
is 'true' and the signed variable can be compared against the 'unsigned'
'sr->mshot_total_len'.

It seems clang isn't as clever.
Perhaps it reloads sel->val from memory - so loses the result of the comparison.
Even swapping the order of the two tests might fix it.
As might caching sel->val in a local (even a signed one).

The comment in the header file for io_br_sel.val doesn't seem to include
the case where 'val' is a length!

The simple fix is to use umin() since all the values are clearly non-negative.

	David