Re: [PATCH] io_uring/zcrx: don't clear master_ctx from the import path

[Jens Axboe]

On Thu, 30 Jul 2026 16:27:41 +0000, Woraphat Khiaodaeng wrote:
> import_zcrx() attaches an existing ifq to another ring.  It never calls
> zcrx_set_ring_ctx() and so never takes the ->master_ctx reference, but
> its error path still passes @ctx to zcrx_unregister(), which clears
> ->master_ctx and drops its percpu_ref whenever ifq->master_ctx == ctx.
> 
> That condition is reachable.  A ring that registers an ifq with a
> non-zero event type_mask gets ->master_ctx pointed at itself, and
> nothing stops it from exporting that ifq with ZCRX_CTRL_EXPORT and
> importing the resulting fd back into the same ring.  Failing the import
> after the refcount bumps -- an argument page mapped PROT_READ makes the
> copy_to_user() in import_zcrx() return -EFAULT -- then clears the
> ->master_ctx owned by the original registration, which is still live.
> 
> [...]

Applied, thanks!

[1/1] io_uring/zcrx: don't clear master_ctx from the import path
      commit: fa1ac3b9eb62918f039276d4d11cc02f682bf93c

Best regards,
-- 
Jens Axboe