netdev - [PATCH v2 2/5] io_uring/zcrx: add refcount to struct io_zcrx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251025191504.3024224-3-dw@davidwei.uk>
Date: Sat, 25 Oct 2025 12:15:01 -0700
From: David Wei <dw@...idwei.uk>
To: io-uring@...r.kernel.org,
	netdev@...r.kernel.org
Cc: Jens Axboe <axboe@...nel.dk>,
	Pavel Begunkov <asml.silence@...il.com>
Subject: [PATCH v2 2/5] io_uring/zcrx: add refcount to struct io_zcrx_ifq

Add a refcount to struct io_zcrx_ifq to track the number of proxy ifqs
that refer to it. The init count is 1 and means there are no proxy ifqs.

This ref is checked in io_shutdown_zcrx_ifqs() to ensure that an ifq is
not cleaned up while there are still proxy ifqs alive.

Opted for a bog standard refcount_t. The increment and decrement
operations are expected to happen during the slow setup/teardown paths
only, and a src ifq is only expected to be shared a handful of times at
most.

Signed-off-by: David Wei <dw@...idwei.uk>
---
 io_uring/zcrx.c | 3 +++
 io_uring/zcrx.h | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index a816f5902091..22d759307c16 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -587,6 +587,7 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
 	if (!ifq)
 		return -ENOMEM;
 	ifq->rq_entries = reg.rq_entries;
+	refcount_set(&ifq->refs, 1);
 
 	scoped_guard(mutex, &ctx->mmap_lock) {
 		/* preallocate id */
@@ -730,6 +731,8 @@ void io_shutdown_zcrx_ifqs(struct io_ring_ctx *ctx)
 	lockdep_assert_held(&ctx->uring_lock);
 
 	xa_for_each(&ctx->zcrx_ctxs, index, ifq) {
+		if (refcount_read(&ifq->refs) > 1)
+			continue;
 		io_zcrx_scrub(ifq);
 		io_close_queue(ifq);
 	}
diff --git a/io_uring/zcrx.h b/io_uring/zcrx.h
index 33ef61503092..566d519cbaf6 100644
--- a/io_uring/zcrx.h
+++ b/io_uring/zcrx.h
@@ -60,6 +60,8 @@ struct io_zcrx_ifq {
 	 */
 	struct mutex			pp_lock;
 	struct io_mapped_region		region;
+
+	refcount_t			refs;
 };
 
 #if defined(CONFIG_IO_URING_ZCRX)
-- 
2.47.3