[PATCH 1/1] io_uring/zcrx: fix post open error handling

[PATCH 1/1] io_uring/zcrx: fix post open error handling

[Pavel Begunkov]

Closing a queue doesn't guarantee that all associated page pools are
terminated right away, let the refcounting do the work instead of
releasing the zcrx ctx directly.

Cc: stable@vger.kernel.org
Fixes: e0793de24a9f6 ("io_uring/zcrx: set pp memory provider for an rx queue")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 006e1bfefa5f..b24d1da2e1ca 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -515,9 +515,6 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
 		.mp_priv = ifq,
 	};
 
-	if (ifq->if_rxq == -1)
-		return;
-
 	scoped_guard(mutex, &ifq->pp_lock) {
 		netdev = ifq->netdev;
 		netdev_tracker = ifq->netdev_tracker;
@@ -525,7 +522,8 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
 	}
 
 	if (netdev) {
-		net_mp_close_rxq(netdev, ifq->if_rxq, &p);
+		if (ifq->if_rxq != -1)
+			net_mp_close_rxq(netdev, ifq->if_rxq, &p);
 		netdev_put(netdev, &netdev_tracker);
 	}
 	ifq->if_rxq = -1;
@@ -833,13 +831,12 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	}
 	return 0;
 netdev_put_unlock:
-	netdev_put(ifq->netdev, &ifq->netdev_tracker);
 	netdev_unlock(ifq->netdev);
 err:
 	scoped_guard(mutex, &ctx->mmap_lock)
 		xa_erase(&ctx->zcrx_ctxs, id);
 ifq_free:
-	io_zcrx_ifq_free(ifq);
+	zcrx_unregister(ifq);
 	return ret;
 }
 
-- 
2.52.0

Re: [PATCH 1/1] io_uring/zcrx: fix post open error handling

[Jens Axboe]

On Sat, 14 Feb 2026 22:20:47 +0000, Pavel Begunkov wrote:
> Closing a queue doesn't guarantee that all associated page pools are
> terminated right away, let the refcounting do the work instead of
> releasing the zcrx ctx directly.
> 
> 

Applied, thanks!

[1/1] io_uring/zcrx: fix post open error handling
      commit: 5d540e4508950c674d6feef1d95463d039bbf4f5

Best regards,
-- 
Jens Axboe

[PATCH 1/1] io_uring/zcrx: fix post open error handling

[Pavel Begunkov]

[ upstream commit 5d540e4508950c674d6feef1d95463d039bbf4f5 ]

5d540e4508950 ("io_uring/zcrx: fix post open error handling") fixes some
post queue open problems. Instead of picking all dependencies for that
patch just move post open error handling out of the way, so once a queue
is open we can always report a success.

Move copy_to_user earlier before open,  and xa_store() should already
never fail as the slot is explicitly pre-allocated.

Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 20 +++++++++-----------
 1 file changed, 9 insertions(+), 11 deletions(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index c524be7109c2..208d03443020 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -625,6 +625,14 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	if (ret)
 		goto netdev_put_unlock;
 
+	reg.zcrx_id = id;
+	if (copy_to_user(arg, &reg, sizeof(reg)) ||
+	    copy_to_user(u64_to_user_ptr(reg.region_ptr), &rd, sizeof(rd)) ||
+	    copy_to_user(u64_to_user_ptr(reg.area_ptr), &area, sizeof(area))) {
+		ret = -EFAULT;
+		goto netdev_put_unlock;
+	}
+
 	mp_param.mp_ops = &io_uring_pp_zc_ops;
 	mp_param.mp_priv = ifq;
 	ret = __net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param, NULL);
@@ -633,21 +641,11 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	netdev_unlock(ifq->netdev);
 	ifq->if_rxq = reg.if_rxq;
 
-	reg.zcrx_id = id;
-
 	scoped_guard(mutex, &ctx->mmap_lock) {
 		/* publish ifq */
-		ret = -ENOMEM;
-		if (xa_store(&ctx->zcrx_ctxs, id, ifq, GFP_KERNEL))
-			goto err;
+		xa_store(&ctx->zcrx_ctxs, id, ifq, GFP_KERNEL);
 	}
 
-	if (copy_to_user(arg, &reg, sizeof(reg)) ||
-	    copy_to_user(u64_to_user_ptr(reg.region_ptr), &rd, sizeof(rd)) ||
-	    copy_to_user(u64_to_user_ptr(reg.area_ptr), &area, sizeof(area))) {
-		ret = -EFAULT;
-		goto err;
-	}
 	return 0;
 netdev_put_unlock:
 	netdev_put(ifq->netdev, &ifq->netdev_tracker);
-- 
2.53.0

Re: [PATCH 1/1] io_uring/zcrx: fix post open error handling

[Pavel Begunkov]

On 3/2/26 22:15, Pavel Begunkov wrote:
> [ upstream commit 5d540e4508950c674d6feef1d95463d039bbf4f5 ]
> 
> 5d540e4508950 ("io_uring/zcrx: fix post open error handling") fixes some
> post queue open problems. Instead of picking all dependencies for that
> patch just move post open error handling out of the way, so once a queue
> is open we can always report a success.
> 
> Move copy_to_user earlier before open,  and xa_store() should already
> never fail as the slot is explicitly pre-allocated.

I somehow lost a stable-6.18 label in the process

-- 
Pavel Begunkov

Re: [PATCH 1/1] io_uring/zcrx: fix post open error handling

[Greg KH]

On Mon, Mar 02, 2026 at 10:15:43PM +0000, Pavel Begunkov wrote:
> [ upstream commit 5d540e4508950c674d6feef1d95463d039bbf4f5 ]
> 
> 5d540e4508950 ("io_uring/zcrx: fix post open error handling") fixes some
> post queue open problems. Instead of picking all dependencies for that
> patch just move post open error handling out of the way, so once a queue
> is open we can always report a success.
> 
> Move copy_to_user earlier before open,  and xa_store() should already
> never fail as the slot is explicitly pre-allocated.
> 
> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  io_uring/zcrx.c | 20 +++++++++-----------
>  1 file changed, 9 insertions(+), 11 deletions(-)

What stable kernel(s) is this for?

thanks,

greg k-h

Re: [PATCH 1/1] io_uring/zcrx: fix post open error handling

[Pavel Begunkov]

On 3/3/26 01:47, Greg KH wrote:
> On Mon, Mar 02, 2026 at 10:15:43PM +0000, Pavel Begunkov wrote:
>> [ upstream commit 5d540e4508950c674d6feef1d95463d039bbf4f5 ]
>>
>> 5d540e4508950 ("io_uring/zcrx: fix post open error handling") fixes some
>> post queue open problems. Instead of picking all dependencies for that
>> patch just move post open error handling out of the way, so once a queue
>> is open we can always report a success.
>>
>> Move copy_to_user earlier before open,  and xa_store() should already
>> never fail as the slot is explicitly pre-allocated.
>>
>> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
>> ---
>>   io_uring/zcrx.c | 20 +++++++++-----------
>>   1 file changed, 9 insertions(+), 11 deletions(-)
> 
> What stable kernel(s) is this for?

6.18 please

-- 
Pavel Begunkov