netdev_get_by_index_lock() might return a netdev that doesn't have qops and also relies on rtnl. We're going to reject it later when opening a queue, but netdev_queue_get_dma_dev() warns before that. Reject non-qops netdevs earlier for now. RTNL: assertion failed at ./include/net/netdev_lock.h (72) WARNING: ./include/net/netdev_lock.h:72 at netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline] WARNING: ./include/net/netdev_lock.h:72 at netdev_queue_get_dma_dev+0x52e/0x660 net/core/netdev_queues.c:43, RIP: 0010:netdev_assert_locked_ops_compat include/net/netdev_lock.h:72 [inline] RIP: 0010:netdev_queue_get_dma_dev+0x53a/0x660 net/core/netdev_queues.c:43 Call Trace: zcrx_register_netdev io_uring/zcrx.c:831 [inline] io_register_zcrx+0xe94/0x1d30 io_uring/zcrx.c:983 __io_uring_register io_uring/register.c:942 [inline] __do_sys_io_uring_register+0x1193/0x1bc0 io_uring/register.c:1040 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Cc: stable@vger.kernel.org Fixes: b6c5f9454ef34 ("io_uring/zcrx: call netdev_queue_get_dma_dev() under instance lock") Reported-by: syzbot+a78926bdac2adb52dc0e@syzkaller.appspotmail.com Signed-off-by: Pavel Begunkov --- io_uring/zcrx.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c index f1464ea8ca64..add91d6d6e52 100644 --- a/io_uring/zcrx.c +++ b/io_uring/zcrx.c @@ -825,6 +825,10 @@ static int zcrx_register_netdev(struct io_zcrx_ifq *ifq, reg->if_idx); if (!ifq->netdev) return -ENODEV; + if (!ifq->netdev->queue_mgmt_ops) { + ret = -EOPNOTSUPP; + goto netdev_put_unlock; + } netdev_hold(ifq->netdev, &ifq->netdev_tracker, GFP_KERNEL); -- 2.54.0