[PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[Pavel Begunkov]

netdev_get_by_index_lock() might return a netdev that doesn't have qops
and also relies on rtnl. We're going to reject it later when opening a
queue, but netdev_queue_get_dma_dev() warns before that. Reject non-qops
netdevs earlier for now.

RTNL: assertion failed at ./include/net/netdev_lock.h (72)
WARNING: ./include/net/netdev_lock.h:72 at netdev_assert_locked_ops_compat
    include/net/netdev_lock.h:72 [inline]
WARNING: ./include/net/netdev_lock.h:72 at netdev_queue_get_dma_dev+0x52e/0x660
    net/core/netdev_queues.c:43,
RIP: 0010:netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline]
RIP: 0010:netdev_queue_get_dma_dev+0x53a/0x660 net/core/netdev_queues.c:43
Call Trace:
 <TASK>
 zcrx_register_netdev io_uring/zcrx.c:831 [inline]
 io_register_zcrx+0xe94/0x1d30 io_uring/zcrx.c:983
 __io_uring_register io_uring/register.c:942 [inline]
 __do_sys_io_uring_register+0x1193/0x1bc0 io_uring/register.c:1040
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Cc: stable@vger.kernel.org
Fixes: b6c5f9454ef34 ("io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock")
Reported-by: syzbot+a78926bdac2adb52dc0e@syzkaller.appspotmail.com
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f1464ea8ca64..add91d6d6e52 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -825,6 +825,10 @@ static int zcrx_register_netdev(struct io_zcrx_ifq *ifq,
 						reg->if_idx);
 	if (!ifq->netdev)
 		return -ENODEV;
+	if (!ifq->netdev->queue_mgmt_ops) {
+		ret = -EOPNOTSUPP;
+		goto netdev_put_unlock;
+	}
 
 	netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
 
-- 
2.54.0

Re: [PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[Jens Axboe]

On Thu, 06 Aug 2026 12:42:33 +0100, Pavel Begunkov wrote:
> netdev_get_by_index_lock() might return a netdev that doesn't have qops
> and also relies on rtnl. We're going to reject it later when opening a
> queue, but netdev_queue_get_dma_dev() warns before that. Reject non-qops
> netdevs earlier for now.
> 
> RTNL: assertion failed at ./include/net/netdev_lock.h (72)
> WARNING: ./include/net/netdev_lock.h:72 at netdev_assert_locked_ops_compat
>     include/net/netdev_lock.h:72 [inline]
> WARNING: ./include/net/netdev_lock.h:72 at netdev_queue_get_dma_dev+0x52e/0x660
>     net/core/netdev_queues.c:43,
> RIP: 0010:netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline]
> RIP: 0010:netdev_queue_get_dma_dev+0x53a/0x660 net/core/netdev_queues.c:43
> Call Trace:
>  <TASK>
>  zcrx_register_netdev io_uring/zcrx.c:831 [inline]
>  io_register_zcrx+0xe94/0x1d30 io_uring/zcrx.c:983
>  __io_uring_register io_uring/register.c:942 [inline]
>  __do_sys_io_uring_register+0x1193/0x1bc0 io_uring/register.c:1040
>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>  do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> 
> [...]

Applied, thanks!

[1/1] io_uring/zcrx: fail non-qops netdevs early
      commit: cf7aa48151deb629022a8b0c61c139dbfa579933

Best regards,
-- 
Jens Axboe

Re: [PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[Jakub Kicinski]

On Thu, 06 Aug 2026 06:00:49 -0600 Jens Axboe wrote:
> On Thu, 06 Aug 2026 12:42:33 +0100, Pavel Begunkov wrote:
> > netdev_get_by_index_lock() might return a netdev that doesn't have qops
> > and also relies on rtnl. We're going to reject it later when opening a
> > queue, but netdev_queue_get_dma_dev() warns before that. Reject non-qops
> > netdevs earlier for now.
> > 
> > RTNL: assertion failed at ./include/net/netdev_lock.h (72)
> > WARNING: ./include/net/netdev_lock.h:72 at netdev_assert_locked_ops_compat
> >     include/net/netdev_lock.h:72 [inline]
> > WARNING: ./include/net/netdev_lock.h:72 at netdev_queue_get_dma_dev+0x52e/0x660
> >     net/core/netdev_queues.c:43,
> > RIP: 0010:netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline]
> > RIP: 0010:netdev_queue_get_dma_dev+0x53a/0x660 net/core/netdev_queues.c:43
> > Call Trace:
> >  <TASK>
> >  zcrx_register_netdev io_uring/zcrx.c:831 [inline]
> >  io_register_zcrx+0xe94/0x1d30 io_uring/zcrx.c:983
> >  __io_uring_register io_uring/register.c:942 [inline]
> >  __do_sys_io_uring_register+0x1193/0x1bc0 io_uring/register.c:1040
> >  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> >  do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
> >  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> > 
> > [...]  
> 
> Applied, thanks!
> 
> [1/1] io_uring/zcrx: fail non-qops netdevs early
>       commit: cf7aa48151deb629022a8b0c61c139dbfa579933

I asked for a different fix :/

https://lore.kernel.org/all/20260805165817.7e1fc367@kernel.org/

Outside subsystems should not be poking at random fields and making
guesses. The assert is simply wrong and should be changed.

Jens, can you drop this please?

Re: [PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[Jens Axboe]

On 8/6/26 7:49 AM, Jakub Kicinski wrote:
> On Thu, 06 Aug 2026 06:00:49 -0600 Jens Axboe wrote:
>> On Thu, 06 Aug 2026 12:42:33 +0100, Pavel Begunkov wrote:
>>> netdev_get_by_index_lock() might return a netdev that doesn't have qops
>>> and also relies on rtnl. We're going to reject it later when opening a
>>> queue, but netdev_queue_get_dma_dev() warns before that. Reject non-qops
>>> netdevs earlier for now.
>>>
>>> RTNL: assertion failed at ./include/net/netdev_lock.h (72)
>>> WARNING: ./include/net/netdev_lock.h:72 at netdev_assert_locked_ops_compat
>>>     include/net/netdev_lock.h:72 [inline]
>>> WARNING: ./include/net/netdev_lock.h:72 at netdev_queue_get_dma_dev+0x52e/0x660
>>>     net/core/netdev_queues.c:43,
>>> RIP: 0010:netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline]
>>> RIP: 0010:netdev_queue_get_dma_dev+0x53a/0x660 net/core/netdev_queues.c:43
>>> Call Trace:
>>>  <TASK>
>>>  zcrx_register_netdev io_uring/zcrx.c:831 [inline]
>>>  io_register_zcrx+0xe94/0x1d30 io_uring/zcrx.c:983
>>>  __io_uring_register io_uring/register.c:942 [inline]
>>>  __do_sys_io_uring_register+0x1193/0x1bc0 io_uring/register.c:1040
>>>  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
>>>  do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
>>>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>>>
>>> [...]  
>>
>> Applied, thanks!
>>
>> [1/1] io_uring/zcrx: fail non-qops netdevs early
>>       commit: cf7aa48151deb629022a8b0c61c139dbfa579933
> 
> I asked for a different fix :/
> 
> https://lore.kernel.org/all/20260805165817.7e1fc367@kernel.org/
> 
> Outside subsystems should not be poking at random fields and making
> guesses. The assert is simply wrong and should be changed.
> 
> Jens, can you drop this please?

Sure, dropped.

-- 
Jens Axboe

Re: [PATCH io_uring-7.2 1/1] io_uring/zcrx: fail non-qops netdevs early

[Jakub Kicinski]

On Thu, 6 Aug 2026 07:51:22 -0600 Jens Axboe wrote:
> On 8/6/26 7:49 AM, Jakub Kicinski wrote:
> > On Thu, 06 Aug 2026 06:00:49 -0600 Jens Axboe wrote:  
> >> Applied, thanks!
> >>
> >> [1/1] io_uring/zcrx: fail non-qops netdevs early
> >>       commit: cf7aa48151deb629022a8b0c61c139dbfa579933  
> > 
> > I asked for a different fix :/
> > 
> > https://lore.kernel.org/all/20260805165817.7e1fc367@kernel.org/
> > 
> > Outside subsystems should not be poking at random fields and making
> > guesses. The assert is simply wrong and should be changed.
> > 
> > Jens, can you drop this please?  
> 
> Sure, dropped.

Thank you! We'll probably ship the fix next week, FWIW. This week's PR
is imminent, don't want to rush it.