Re: [syzbot] [io-uring?] [net?] WARNING: refcount bug in zcrx_unregister_user

From: Edward Adam Davis

Date: Wed Aug 12 2026 - 05:43:49 EST


#syz test

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f1464ea8ca64..75f799f20818 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -550,6 +550,7 @@ static struct io_zcrx_ifq *io_zcrx_ifq_alloc(struct io_ring_ctx *ctx)

static void io_zcrx_drop_netdev(struct io_zcrx_ifq *ifq)
{
+ BUG_ON(ifq);
guard(mutex)(&ifq->pp_lock);

if (!ifq->netdev)
@@ -567,6 +568,7 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
.mp_priv = ifq,
};

+ printk("ifq: %p, %s\n", ifq, __func__);
scoped_guard(mutex, &ifq->pp_lock) {
netdev = ifq->netdev;
netdev_tracker = ifq->netdev_tracker;