io_uring/zcrx: fix post open error handling

Closing a queue doesn't guarantee that all associated page pools are
terminated right away, let the refcounting do the work instead of
releasing the zcrx ctx directly.

Cc: stable@vger.kernel.org
Fixes: e0793de24a ("io_uring/zcrx: set pp memory provider for an rx queue")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Pavel Begunkov 2026-02-14 22:20:47 +00:00 committed by Jens Axboe
parent a983aae397
commit 5d540e4508

View file

@ -515,9 +515,6 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
.mp_priv = ifq,
};
if (ifq->if_rxq == -1)
return;
scoped_guard(mutex, &ifq->pp_lock) {
netdev = ifq->netdev;
netdev_tracker = ifq->netdev_tracker;
@ -525,7 +522,8 @@ static void io_close_queue(struct io_zcrx_ifq *ifq)
}
if (netdev) {
net_mp_close_rxq(netdev, ifq->if_rxq, &p);
if (ifq->if_rxq != -1)
net_mp_close_rxq(netdev, ifq->if_rxq, &p);
netdev_put(netdev, &netdev_tracker);
}
ifq->if_rxq = -1;
@ -833,13 +831,12 @@ int io_register_zcrx_ifq(struct io_ring_ctx *ctx,
}
return 0;
netdev_put_unlock:
netdev_put(ifq->netdev, &ifq->netdev_tracker);
netdev_unlock(ifq->netdev);
err:
scoped_guard(mutex, &ctx->mmap_lock)
xa_erase(&ctx->zcrx_ctxs, id);
ifq_free:
io_zcrx_ifq_free(ifq);
zcrx_unregister(ifq);
return ret;
}