[PATCH 1/1] io_uring/zcrx: fix area release on registration failure

[PATCH 1/1] io_uring/zcrx: fix area release on registration failure

[Pavel Begunkov]

On area registration failure there might be no ifq set and it's not safe
to access area->ifq in the release path without checking it first.

Cc: stable@vger.kernel.org
Fixes: f12ecf5e1c5ec ("io_uring/zcrx: fix late dma unmap for a dead dev")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index b037add86793..543796da5686 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -374,7 +374,8 @@ static void io_free_rbuf_ring(struct io_zcrx_ifq *ifq)
 
 static void io_zcrx_free_area(struct io_zcrx_area *area)
 {
-	io_zcrx_unmap_area(area->ifq, area);
+	if (area->ifq)
+		io_zcrx_unmap_area(area->ifq, area);
 	io_release_area_mem(&area->mem);
 
 	kvfree(area->freelist);
-- 
2.49.0

Re: [PATCH 1/1] io_uring/zcrx: fix area release on registration failure

[Jens Axboe]

On Tue, 27 May 2025 18:07:33 +0100, Pavel Begunkov wrote:
> On area registration failure there might be no ifq set and it's not safe
> to access area->ifq in the release path without checking it first.
> 
> 

Applied, thanks!

[1/1] io_uring/zcrx: fix area release on registration failure
      (no commit info)

Best regards,
-- 
Jens Axboe