FAILED: Patch "io_uring/zcrx: fix post open error handling" failed to apply to 6.18-stable tree

FAILED: Patch "io_uring/zcrx: fix post open error handling" failed to apply to 6.18-stable tree

[Sasha Levin]

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

Thanks,
Sasha

------------------ original commit in Linus's tree ------------------

From 5d540e4508950c674d6feef1d95463d039bbf4f5 Mon Sep 17 00:00:00 2001
From: Pavel Begunkov <asml.silence@gmail.com>
Date: Sat, 14 Feb 2026 22:20:47 +0000
Subject: [PATCH] io_uring/zcrx: fix post open error handling

Closing a queue doesn't guarantee that all associated page pools are
terminated right away, let the refcounting do the work instead of
releasing the zcrx ctx directly.

Cc: stable@vger.kernel.org
Fixes: e0793de24a9f6 ("io_uring/zcrx: set pp memory provider for an rx queue")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
---
 io_uring/zcrx.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 006e1bfefa5f2..b24d1da2e1ca4 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -515,9 +515,6 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
 		.mp_priv = ifq,
 	};
 
-	if (ifq->if_rxq == -1)
-		return;
-
 	scoped_guard(mutex, &ifq->pp_lock) {
 		netdev = ifq->netdev;
 		netdev_tracker = ifq->netdev_tracker;
@@ -525,7 +522,8 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
 	}
 
 	if (netdev) {
-		net_mp_close_rxq(netdev, ifq->if_rxq, &p);
+		if (ifq->if_rxq != -1)
+			net_mp_close_rxq(netdev, ifq->if_rxq, &p);
 		netdev_put(netdev, &netdev_tracker);
 	}
 	ifq->if_rxq = -1;
@@ -833,13 +831,12 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	}
 	return 0;
 netdev_put_unlock:
-	netdev_put(ifq->netdev, &ifq->netdev_tracker);
 	netdev_unlock(ifq->netdev);
 err:
 	scoped_guard(mutex, &ctx->mmap_lock)
 		xa_erase(&ctx->zcrx_ctxs, id);
 ifq_free:
-	io_zcrx_ifq_free(ifq);
+	zcrx_unregister(ifq);
 	return ret;
 }
 
-- 
2.51.0

Re: FAILED: Patch "io_uring/zcrx: fix post open error handling" failed to apply to 6.18-stable tree

[Jens Axboe]

On 2/28/26 6:17 PM, Sasha Levin wrote:
> The patch below does not apply to the 6.18-stable tree.
> If someone wants it applied there, or to any other stable or longterm
> tree, then please email the backport, including the original git commit
> id to <stable@vger.kernel.org>.

Looks like this has dependencies on parts of this:

https://lore.kernel.org/io-uring/cover.1763029704.git.asml.silence@gmail.com/

series. But seems easier to just do a variant for the 6.18 base,
I'll leave that to Pavel.

-- 
Jens Axboe

Re: FAILED: Patch "io_uring/zcrx: fix post open error handling" failed to apply to 6.18-stable tree

[Pavel Begunkov]

On 3/1/26 13:22, Jens Axboe wrote:
> On 2/28/26 6:17 PM, Sasha Levin wrote:
>> The patch below does not apply to the 6.18-stable tree.
>> If someone wants it applied there, or to any other stable or longterm
>> tree, then please email the backport, including the original git commit
>> id to <stable@vger.kernel.org>.
> 
> Looks like this has dependencies on parts of this:
> 
> https://lore.kernel.org/io-uring/cover.1763029704.git.asml.silence@gmail.com/
> 
> series. But seems easier to just do a variant for the 6.18 base,
> I'll leave that to Pavel.

I was thinking to remove post open error handling. xarray is preallocated
and shouldn't fail. And copy_to_user can be moved earlier. Should be safer
than taking all deps.

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index c524be7109c2..c6ac7365acae 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -625,6 +625,14 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
  	if (ret)
  		goto netdev_put_unlock;
  
+	reg.zcrx_id = id;
+	if (copy_to_user(arg, &reg, sizeof(reg)) ||
+	    copy_to_user(u64_to_user_ptr(reg.region_ptr), &rd, sizeof(rd)) ||
+	    copy_to_user(u64_to_user_ptr(reg.area_ptr), &area, sizeof(area))) {
+		ret = -EFAULT;
+		goto err;
+	}
+
  	mp_param.mp_ops = &io_uring_pp_zc_ops;
  	mp_param.mp_priv = ifq;
  	ret = __net_mp_open_rxq(ifq->netdev, reg.if_rxq, &mp_param, NULL);
@@ -633,21 +641,11 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
  	netdev_unlock(ifq->netdev);
  	ifq->if_rxq = reg.if_rxq;
  
-	reg.zcrx_id = id;
-
  	scoped_guard(mutex, &ctx->mmap_lock) {
  		/* publish ifq */
-		ret = -ENOMEM;
-		if (xa_store(&ctx->zcrx_ctxs, id, ifq, GFP_KERNEL))
-			goto err;
+		xa_store(&ctx->zcrx_ctxs, id, ifq, GFP_KERNEL);
  	}
  
-	if (copy_to_user(arg, &reg, sizeof(reg)) ||
-	    copy_to_user(u64_to_user_ptr(reg.region_ptr), &rd, sizeof(rd)) ||
-	    copy_to_user(u64_to_user_ptr(reg.area_ptr), &area, sizeof(area))) {
-		ret = -EFAULT;
-		goto err;
-	}
  	return 0;
  netdev_put_unlock:
  	netdev_put(ifq->netdev, &ifq->netdev_tracker);

  
-- 
Pavel Begunkov

Re: FAILED: Patch "io_uring/zcrx: fix post open error handling" failed to apply to 6.18-stable tree

[Jens Axboe]

On 3/2/26 3:02 AM, Pavel Begunkov wrote:
> On 3/1/26 13:22, Jens Axboe wrote:
>> On 2/28/26 6:17 PM, Sasha Levin wrote:
>>> The patch below does not apply to the 6.18-stable tree.
>>> If someone wants it applied there, or to any other stable or longterm
>>> tree, then please email the backport, including the original git commit
>>> id to <stable@vger.kernel.org>.
>>
>> Looks like this has dependencies on parts of this:
>>
>> https://lore.kernel.org/io-uring/cover.1763029704.git.asml.silence@gmail.com/
>>
>> series. But seems easier to just do a variant for the 6.18 base,
>> I'll leave that to Pavel.
> 
> I was thinking to remove post open error handling. xarray is preallocated
> and shouldn't fail. And copy_to_user can be moved earlier. Should be safer
> than taking all deps.

Agree, that looks good to me.

-- 
Jens Axboe