Re: Linux: DMA-after-unmap race in ZCRX via netif_rxq_cleanup_unlease() ordering inversion (netkit + page_pool)

[Jacob Bachmeyer <jcb62281 () gmail com>]

On 5/27/26 17:53, Prénom? Ahmed wrote:
> Hello,
>
> I would like to report a source-proven teardown ordering bug in the 
> Linux kernel that can lead to a DMA-after-unmap race condition 
> involving ZCRX (io_uring zero-copy receive), page_pool, and netkit 
> queue leasing.
>
> ***Reporter:** Ahmed Abdelmoemen **Discovery Date:** 2026-05-26 
> **Kernel Version:** Linux 7.1.0-rc3*
>
> Executive Summary
>
> [...] I am happy to provide more details or assist with testing.
This report reads like the product of an "AI" system.  What "AI" 
assisted you in preparing this report?

[I am sending this to the lists to ensure that everyone will know that 
this question has been asked, in an effort to avoid deluging the 
reporter with this question.]


-- Jacob