[PATCH v2 0/2] net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock

[PATCH v2 0/2] net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock

[David Wei]

netdev ops must be called under instance lock or rtnl_lock, but
io_register_zcrx_ifq() isn't doing this for netdev_queue_get_dma_dev().
Fix this by taking the instance lock using netdev_get_by_index_lock().

netdev_get_by_index_lock() isn't exported by default, so the first patch
is a prep patch to export this under linux/netdevice.h.

Extended the instance lock section to include attaching a memory
provider. Could not move io_zcrx_create_area() outside, since the dmabuf
codepath IORING_ZCRX_AREA_DMABUF requires ifq->dev. Happy to do whatever
here, either keep this extended section or relock for net_mp_open_rxq().

v2:
 - add Fixes tag
 - export netdev_get_by_index_lock()
 - use netdev_get_by_index_lock() + netdev_hold()
 - extend lock section to include net_mp_open_rxq()

David Wei (2):
  net: export netdev_get_by_index_lock()
  net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance
    lock

 include/linux/netdevice.h |  1 +
 io_uring/zcrx.c           | 15 +++++++++------
 net/core/dev.c            |  1 +
 net/core/dev.h            |  1 -
 4 files changed, 11 insertions(+), 7 deletions(-)

-- 
2.47.3

[PATCH v2 1/2] net: export netdev_get_by_index_lock()

[David Wei]

Need to call netdev_get_by_index_lock() from io_uring/zcrx.c, but it is
currently private to net. Export the function in linux/netdevice.h.

Signed-off-by: David Wei <dw@davidwei.uk>
---
 include/linux/netdevice.h | 1 +
 net/core/dev.c            | 1 +
 net/core/dev.h            | 1 -
 3 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d1a687444b27..77c46a2823ec 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3401,6 +3401,7 @@ struct net_device *dev_get_by_index(struct net *net, int ifindex);
 struct net_device *__dev_get_by_index(struct net *net, int ifindex);
 struct net_device *netdev_get_by_index(struct net *net, int ifindex,
 				       netdevice_tracker *tracker, gfp_t gfp);
+struct net_device *netdev_get_by_index_lock(struct net *net, int ifindex);
 struct net_device *netdev_get_by_name(struct net *net, const char *name,
 				      netdevice_tracker *tracker, gfp_t gfp);
 struct net_device *netdev_get_by_flags_rcu(struct net *net, netdevice_tracker *tracker,
diff --git a/net/core/dev.c b/net/core/dev.c
index 2acfa44927da..7e4ef9a915f9 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1089,6 +1089,7 @@ struct net_device *netdev_get_by_index_lock(struct net *net, int ifindex)
 
 	return __netdev_put_lock(dev, net);
 }
+EXPORT_SYMBOL(netdev_get_by_index_lock);
 
 struct net_device *
 netdev_get_by_index_lock_ops_compat(struct net *net, int ifindex)
diff --git a/net/core/dev.h b/net/core/dev.h
index 900880e8b5b4..df8a90fe89f8 100644
--- a/net/core/dev.h
+++ b/net/core/dev.h
@@ -29,7 +29,6 @@ struct napi_struct *
 netdev_napi_by_id_lock(struct net *net, unsigned int napi_id);
 struct net_device *dev_get_by_napi_id(unsigned int napi_id);
 
-struct net_device *netdev_get_by_index_lock(struct net *net, int ifindex);
 struct net_device *__netdev_put_lock(struct net_device *dev, struct net *net);
 struct net_device *
 netdev_xa_find_lock(struct net *net, struct net_device *dev,
-- 
2.47.3

Re: [PATCH v2 1/2] net: export netdev_get_by_index_lock()

[Jakub Kicinski]

On Wed, 29 Oct 2025 16:16:53 -0700 David Wei wrote:
> +EXPORT_SYMBOL(netdev_get_by_index_lock);

I don't think io_uring can be a module? No need to export

Re: [PATCH v2 1/2] net: export netdev_get_by_index_lock()

[David Wei]

On 2025-10-29 16:51, Jakub Kicinski wrote:
> On Wed, 29 Oct 2025 16:16:53 -0700 David Wei wrote:
>> +EXPORT_SYMBOL(netdev_get_by_index_lock);
> 
> I don't think io_uring can be a module? No need to export

Got it, will remove.

[PATCH v2 2/2] net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock

[David Wei]

netdev ops must be called under instance lock or rtnl_lock, but
io_register_zcrx_ifq() isn't doing this for netdev_queue_get_dma_dev().
Fix this by taking the instance lock using netdev_get_by_index_lock().

Extended the instance lock section to include attaching a memory
provider. Could not move io_zcrx_create_area() outside, since the dmabuf
codepath IORING_ZCRX_AREA_DMABUF requires ifq->dev.

Fixes: 59b8b32ac8d4 ("io_uring/zcrx: add support for custom DMA devices")
Signed-off-by: David Wei <dw@davidwei.uk>
---
 io_uring/zcrx.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index a816f5902091..5599883f8941 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -599,27 +599,28 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	if (ret)
 		goto err;
 
-	ifq->netdev = netdev_get_by_index(current->nsproxy->net_ns, reg.if_idx,
-					  &ifq->netdev_tracker, GFP_KERNEL);
+	ifq->netdev = netdev_get_by_index_lock(current->nsproxy->net_ns, reg.if_idx);
 	if (!ifq->netdev) {
 		ret = -ENODEV;
-		goto err;
+		goto netdev_unlock;
 	}
 
 	ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, reg.if_rxq);
 	if (!ifq->dev) {
 		ret = -EOPNOTSUPP;
-		goto err;
+		goto netdev_unlock;
 	}
+	netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
 	get_device(ifq->dev);
 
 	ret = io_zcrx_create_area(ifq, &area);
 	if (ret)
-		goto err;
+		goto netdev_unlock;
 
 	mp_param.mp_ops = &io_uring_pp_zc_ops;
 	mp_param.mp_priv = ifq;
-	ret = net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param);
+	ret = __net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param, NULL);
+	netdev_unlock(ifq->netdev);
 	if (ret)
 		goto err;
 	ifq->if_rxq = reg.if_rxq;
@@ -640,6 +641,8 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 		goto err;
 	}
 	return 0;
+netdev_unlock:
+	netdev_unlock(ifq->netdev);
 err:
 	scoped_guard(mutex, &ctx->mmap_lock)
 		xa_erase(&ctx->zcrx_ctxs, id);
-- 
2.47.3

Re: [PATCH v2 2/2] net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock

[Jakub Kicinski]

On Wed, 29 Oct 2025 16:16:54 -0700 David Wei wrote:
> +	ifq->netdev = netdev_get_by_index_lock(current->nsproxy->net_ns, reg.if_idx);
>  	if (!ifq->netdev) {
>  		ret = -ENODEV;
> -		goto err;
> +		goto netdev_unlock;
>  	}
>  
>  	ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, reg.if_rxq);
>  	if (!ifq->dev) {
>  		ret = -EOPNOTSUPP;
> -		goto err;
> +		goto netdev_unlock;
>  	}
> +	netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
>  	get_device(ifq->dev);
>  
>  	ret = io_zcrx_create_area(ifq, &area);
>  	if (ret)
> -		goto err;
> +		goto netdev_unlock;

Without looking at larger context this looks sus.
You're jumping to the same label before and after you took the ref on
the netdev..

Re: [PATCH v2 2/2] net: io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock

[David Wei]

On 2025-10-29 16:54, Jakub Kicinski wrote:
> On Wed, 29 Oct 2025 16:16:54 -0700 David Wei wrote:
>> +	ifq->netdev = netdev_get_by_index_lock(current->nsproxy->net_ns, reg.if_idx);
>>   	if (!ifq->netdev) {
>>   		ret = -ENODEV;
>> -		goto err;
>> +		goto netdev_unlock;
>>   	}
>>   
>>   	ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, reg.if_rxq);
>>   	if (!ifq->dev) {
>>   		ret = -EOPNOTSUPP;
>> -		goto err;
>> +		goto netdev_unlock;
>>   	}
>> +	netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
>>   	get_device(ifq->dev);
>>   
>>   	ret = io_zcrx_create_area(ifq, &area);
>>   	if (ret)
>> -		goto err;
>> +		goto netdev_unlock;
> 
> Without looking at larger context this looks sus.
> You're jumping to the same label before and after you took the ref on
> the netdev..

Sorry you're right, and actually io_zcrx_ifq_free() does netdev_put()
unconditionally. I'll correct this in v3.