From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

zcrx registration can fail for netdevices that do not support the
required ops locking model.

netdev_queue_get_dma_dev() requires ops locking support.
Calling it for devices without ops lock support triggers
netdev_assert_locked_ops_compat().

Check netdev_need_ops_lock() before accessing queue DMA information
and return -EOPNOTSUPP for unsupported devices.

Reported-by: syzbot+a78926bdac2adb52dc0e@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=a78926bdac2adb52dc0e
Signed-off-by: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>

---
Testing:
 - Verified the reported reproducer in a VM.
---
 io_uring/zcrx.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index f1464ea8ca64..2eba7d4e4483 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -17,6 +17,7 @@
 #include <net/netdev_rx_queue.h>
 #include <net/tcp.h>
 #include <net/rps.h>
+#include <net/netdev_lock.h>
 
 #include <trace/events/page_pool.h>
 
@@ -828,6 +829,15 @@ static int zcrx_register_netdev(struct io_zcrx_ifq *ifq,
 
 	netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL);
 
+	/*
+	 * netdev_queue_get_dma_dev() requires the netdev ops locking
+	 * model. Reject devices which do not support it.
+	 */
+	if (!netdev_need_ops_lock(ifq->netdev)) {
+		ret = -EOPNOTSUPP;
+		goto netdev_put_unlock;
+	}
+
 	ifq->dev = netdev_queue_get_dma_dev(ifq->netdev, if_rxq, NETDEV_QUEUE_TYPE_RX);
 	if (!ifq->dev) {
 		ret = -EOPNOTSUPP;
-- 
2.43.0

On Wed, Aug 5, 2026 at 7:00 AM <pavankumaryalagada@gmail.com> wrote:
>
> From: Yalagada Pavan Kumar <pavankumaryalagada@gmail.com>
>
> zcrx registration can fail for netdevices that do not support the
> required ops locking model.
>
> netdev_queue_get_dma_dev() requires ops locking support.
> Calling it for devices without ops lock support triggers
> netdev_assert_locked_ops_compat().
>

Ha! netif_mp_open_rxq() does check for the ops locking support, but
get_dma_dev runs before netif_mpu_open_rxq. I would prefer a fix that
doesn't require every caller to add this check. Maybe make the
function return -EOPNOTSUPP instead of asserting? Or changing the call
sequence so that netif_mp_open_rxq is called before get_dma_dev()?
Pavel?
-- 
Thanks,
Mina