linux-kernel - Re: [PATCH net-next] page_pool: check if nmdesc->pp is !NULL to confirm its usage as pp for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251016072132.GA19434@system.software.com>
Date: Thu, 16 Oct 2025 16:21:32 +0900
From: Byungchul Park <byungchul@...com>
To: axboe@...nel.dk, kuba@...nel.org, pabeni@...hat.com,
	almasrymina@...gle.com, asml.silence@...il.com
Cc: davem@...emloft.net, edumazet@...gle.com, horms@...nel.org,
	hawk@...nel.org, ilias.apalodimas@...aro.org, sdf@...ichev.me,
	dw@...idwei.uk, ap420073@...il.com, dtatulea@...dia.com,
	toke@...hat.com, io-uring@...r.kernel.org,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	kernel_team@...ynix.com, max.byungchul.park@...il.com
Subject: Re: [PATCH net-next] page_pool: check if nmdesc->pp is !NULL to
 confirm its usage as pp for net_iov

On Thu, Oct 16, 2025 at 03:36:57PM +0900, Byungchul Park wrote:
> ->pp_magic field in struct page is current used to identify if a page
> belongs to a page pool.  However, ->pp_magic will be removed and page
> type bit in struct page e.g. PGTY_netpp should be used for that purpose.
> 
> As a preparation, the check for net_iov, that is not page-backed, should
> avoid using ->pp_magic since net_iov doens't have to do with page type.
> Instead, nmdesc->pp can be used if a net_iov or its nmdesc belongs to a
> page pool, by making sure nmdesc->pp is NULL otherwise.
> 
> For page-backed netmem, just leave unchanged as is, while for net_iov,
> make sure nmdesc->pp is initialized to NULL and use nmdesc->pp for the
> check.

IIRC,

Suggested-by: Pavel Begunkov <asml.silence@...il.com>

	Byungchul

> Signed-off-by: Byungchul Park <byungchul@...com>
> ---
>  io_uring/zcrx.c        |  4 ++++
>  net/core/devmem.c      |  1 +
>  net/core/netmem_priv.h |  6 ++++++
>  net/core/page_pool.c   | 16 ++++++++++++++--
>  4 files changed, 25 insertions(+), 2 deletions(-)
> 
> diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
> index 723e4266b91f..cf78227c0ca6 100644
> --- a/io_uring/zcrx.c
> +++ b/io_uring/zcrx.c
> @@ -450,6 +450,10 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
>  		area->freelist[i] = i;
>  		atomic_set(&area->user_refs[i], 0);
>  		niov->type = NET_IOV_IOURING;
> +
> +		/* niov->desc.pp is already initialized to NULL by
> +		 * kvmalloc_array(__GFP_ZERO).
> +		 */
>  	}
>  
>  	area->free_count = nr_iovs;
> diff --git a/net/core/devmem.c b/net/core/devmem.c
> index d9de31a6cc7f..f81b700f1fd1 100644
> --- a/net/core/devmem.c
> +++ b/net/core/devmem.c
> @@ -291,6 +291,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
>  			niov = &owner->area.niovs[i];
>  			niov->type = NET_IOV_DMABUF;
>  			niov->owner = &owner->area;
> +			niov->desc.pp = NULL;
>  			page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
>  						      net_devmem_get_dma_addr(niov));
>  			if (direction == DMA_TO_DEVICE)
> diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> index 23175cb2bd86..fb21cc19176b 100644
> --- a/net/core/netmem_priv.h
> +++ b/net/core/netmem_priv.h
> @@ -22,6 +22,12 @@ static inline void netmem_clear_pp_magic(netmem_ref netmem)
>  
>  static inline bool netmem_is_pp(netmem_ref netmem)
>  {
> +	/* Use ->pp for net_iov to identify if it's pp, which requires
> +	 * that non-pp net_iov should have ->pp NULL'd.
> +	 */
> +	if (netmem_is_net_iov(netmem))
> +		return !!netmem_to_nmdesc(netmem)->pp;
> +
>  	return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
>  }
>  
> diff --git a/net/core/page_pool.c b/net/core/page_pool.c
> index 1a5edec485f1..2756b78754b0 100644
> --- a/net/core/page_pool.c
> +++ b/net/core/page_pool.c
> @@ -699,7 +699,13 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
>  void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
>  {
>  	netmem_set_pp(netmem, pool);
> -	netmem_or_pp_magic(netmem, PP_SIGNATURE);
> +
> +	/* For page-backed, pp_magic is used to identify if it's pp.
> +	 * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
> +	 * and nmdesc->pp is NULL if it's not.
> +	 */
> +	if (!netmem_is_net_iov(netmem))
> +		netmem_or_pp_magic(netmem, PP_SIGNATURE);
>  
>  	/* Ensuring all pages have been split into one fragment initially:
>  	 * page_pool_set_pp_info() is only called once for every page when it
> @@ -714,7 +720,13 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
>  
>  void page_pool_clear_pp_info(netmem_ref netmem)
>  {
> -	netmem_clear_pp_magic(netmem);
> +	/* For page-backed, pp_magic is used to identify if it's pp.
> +	 * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
> +	 * and nmdesc->pp is NULL if it's not.
> +	 */
> +	if (!netmem_is_net_iov(netmem))
> +		netmem_clear_pp_magic(netmem);
> +
>  	netmem_set_pp(netmem, NULL);
>  }
>  
> 
> base-commit: e1f5bb196f0b0eee197e06d361f8ac5f091c2963
> -- 
> 2.17.1