[PATCH] io_uring/zcrx: reject netdevices without ops lock support

From: pavankumaryalagada

Date: Wed Aug 05 2026 - 09:30:49 EST


From: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>

zcrx registration can fail for netdevices that do not support the
required ops locking model.

netdev_queue_get_dma_dev() requires ops locking support.
Calling it for devices without ops lock support triggers
netdev_assert_locked_ops_compat().

Check netdev_need_ops_lock() before accessing queue DMA information
and return -EOPNOTSUPP for unsupported devices.

Reported-by: syzbot+a78926bdac2adb52dc0e@xxxxxxxxxxxxxxxxxxxxxxxxx
Link: https://syzkaller.appspot.com/bug?extid=a78926bdac2adb52dc0e
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@xxxxxxxxx>

---
Testing:
- Verified the reported reproducer in a VM.
---
io_uring/zcrx.c | 10 ++++++++++
1 file changed, 10 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f1464ea8ca64..2eba7d4e4483 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -17,6 +17,7 @@
#include <net/netdev_rx_queue.h>
#include <net/tcp.h>
#include <net/rps.h>
+#include <net/netdev_lock.h>

#include <trace/events/page_pool.h>

@@ -828,6 +829,15 @@ static int zcrx_register_netdev(struct io_zcrx_ifq *ifq,

netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);

+ /*
+ * netdev_queue_get_dma_dev() requires the netdev ops locking
+ * model. Reject devices which do not support it.
+ */
+ if (!netdev_need_ops_lock(ifq->netdev)) {
+ ret = -EOPNOTSUPP;
+ goto netdev_put_unlock;
+ }
+
ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, if_rxq, NETDEV_QUEUE_TYPE_RX);
if (!ifq->dev) {
ret = -EOPNOTSUPP;
--
2.43.0