[PATCH 1/1] io_uring/zcrx: warn on freelist violations

[PATCH 1/1] io_uring/zcrx: warn on freelist violations

[Pavel Begunkov]

The freelist is appropriately sized to always be able to take a free
niov, but let's be more defensive and check the invariant with a
warning. That should help to catch any double-free issues.

Suggested-by: Kai Aizen <kai@snailsploit.com>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
---
 io_uring/zcrx.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 2eb09219f0a0..7b93c87b8371 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c
@@ -602,6 +602,8 @@ static void io_zcrx_return_niov_freelist(struct net_iov *niov)
 	struct io_zcrx_area *area = io_zcrx_iov_to_area(niov);
 
 	guard(spinlock_bh)(&area->freelist_lock);
+	if (WARN_ON_ONCE(area->free_count >= area->nia.num_niovs))
+		return;
 	area->freelist[area->free_count++] = net_iov_idx(niov);
 }
 
-- 
2.53.0

Re: [PATCH 1/1] io_uring/zcrx: warn on freelist violations

[Jens Axboe]

On Tue, 21 Apr 2026 09:45:29 +0100, Pavel Begunkov wrote:
> The freelist is appropriately sized to always be able to take a free
> niov, but let's be more defensive and check the invariant with a
> warning. That should help to catch any double-free issues.

Applied, thanks!

[1/1] io_uring/zcrx: warn on freelist violations
      commit: 04756ab59ac4eaf2a4f807cca8f4dde859bc02d9

Best regards,
-- 
Jens Axboe