linux-kernel - Re: [PATCH net-next] page_pool: check if nmdesc->pp is !NULL to confirm its usage as pp for net

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251017062614.GA57077@system.software.com>
Date: Fri, 17 Oct 2025 15:26:14 +0900
From: Byungchul Park <byungchul@...com>
To: almasrymina@...gle.com
Cc: davem@...emloft.net, edumazet@...gle.com, horms@...nel.org,
	hawk@...nel.org, ilias.apalodimas@...aro.org, sdf@...ichev.me,
	dw@...idwei.uk, ap420073@...il.com, dtatulea@...dia.com,
	toke@...hat.com, io-uring@...r.kernel.org,
	linux-kernel@...r.kernel.org, netdev@...r.kernel.org,
	kernel_team@...ynix.com, max.byungchul.park@...il.com,
	ziy@...dia.com, willy@...radead.org, david@...hat.com,
	axboe@...nel.dk, kuba@...nel.org, pabeni@...hat.com,
	asml.silence@...il.com
Subject: Re: [PATCH net-next] page_pool: check if nmdesc->pp is !NULL to
 confirm its usage as pp for net_iov

On Fri, Oct 17, 2025 at 08:31:39AM +0900, Byungchul Park wrote:
> On Thu, Oct 16, 2025 at 03:36:57PM +0900, Byungchul Park wrote:
> > ->pp_magic field in struct page is current used to identify if a page
> > belongs to a page pool.  However, ->pp_magic will be removed and page
> > type bit in struct page e.g. PGTY_netpp should be used for that purpose.
> > 
> > As a preparation, the check for net_iov, that is not page-backed, should
> > avoid using ->pp_magic since net_iov doens't have to do with page type.
> > Instead, nmdesc->pp can be used if a net_iov or its nmdesc belongs to a
> > page pool, by making sure nmdesc->pp is NULL otherwise.
> > 
> > For page-backed netmem, just leave unchanged as is, while for net_iov,
> > make sure nmdesc->pp is initialized to NULL and use nmdesc->pp for the
> > check.

Hi Mina,

This patch extracts the network part from the following work:

  https://lore.kernel.org/all/20250729110210.48313-1-byungchul@sk.com/

Can I keep your reviewed-by tag on this patch?

  Reviewed-by: Mina Almasry <almasrymina@...gle.com>

	Byungchul

> +cc David Hildenbrand <david@...hat.com>
> +cc Zi Yan <ziy@...dia.com>
> +cc willy@...radead.org
> 
> 	Byungchul
> > 
> > Signed-off-by: Byungchul Park <byungchul@...com>
> > ---
> >  io_uring/zcrx.c        |  4 ++++
> >  net/core/devmem.c      |  1 +
> >  net/core/netmem_priv.h |  6 ++++++
> >  net/core/page_pool.c   | 16 ++++++++++++++--
> >  4 files changed, 25 insertions(+), 2 deletions(-)
> > 
> > diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
> > index 723e4266b91f..cf78227c0ca6 100644
> > --- a/io_uring/zcrx.c
> > +++ b/io_uring/zcrx.c
> > @@ -450,6 +450,10 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq,
> >  		area->freelist[i] = i;
> >  		atomic_set(&area->user_refs[i], 0);
> >  		niov->type = NET_IOV_IOURING;
> > +
> > +		/* niov->desc.pp is already initialized to NULL by
> > +		 * kvmalloc_array(__GFP_ZERO).
> > +		 */
> >  	}
> >  
> >  	area->free_count = nr_iovs;
> > diff --git a/net/core/devmem.c b/net/core/devmem.c
> > index d9de31a6cc7f..f81b700f1fd1 100644
> > --- a/net/core/devmem.c
> > +++ b/net/core/devmem.c
> > @@ -291,6 +291,7 @@ net_devmem_bind_dmabuf(struct net_device *dev,
> >  			niov = &owner->area.niovs[i];
> >  			niov->type = NET_IOV_DMABUF;
> >  			niov->owner = &owner->area;
> > +			niov->desc.pp = NULL;
> >  			page_pool_set_dma_addr_netmem(net_iov_to_netmem(niov),
> >  						      net_devmem_get_dma_addr(niov));
> >  			if (direction == DMA_TO_DEVICE)
> > diff --git a/net/core/netmem_priv.h b/net/core/netmem_priv.h
> > index 23175cb2bd86..fb21cc19176b 100644
> > --- a/net/core/netmem_priv.h
> > +++ b/net/core/netmem_priv.h
> > @@ -22,6 +22,12 @@ static inline void netmem_clear_pp_magic(netmem_ref netmem)
> >  
> >  static inline bool netmem_is_pp(netmem_ref netmem)
> >  {
> > +	/* Use ->pp for net_iov to identify if it's pp, which requires
> > +	 * that non-pp net_iov should have ->pp NULL'd.
> > +	 */
> > +	if (netmem_is_net_iov(netmem))
> > +		return !!netmem_to_nmdesc(netmem)->pp;
> > +
> >  	return (netmem_get_pp_magic(netmem) & PP_MAGIC_MASK) == PP_SIGNATURE;
> >  }
> >  
> > diff --git a/net/core/page_pool.c b/net/core/page_pool.c
> > index 1a5edec485f1..2756b78754b0 100644
> > --- a/net/core/page_pool.c
> > +++ b/net/core/page_pool.c
> > @@ -699,7 +699,13 @@ s32 page_pool_inflight(const struct page_pool *pool, bool strict)
> >  void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
> >  {
> >  	netmem_set_pp(netmem, pool);
> > -	netmem_or_pp_magic(netmem, PP_SIGNATURE);
> > +
> > +	/* For page-backed, pp_magic is used to identify if it's pp.
> > +	 * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
> > +	 * and nmdesc->pp is NULL if it's not.
> > +	 */
> > +	if (!netmem_is_net_iov(netmem))
> > +		netmem_or_pp_magic(netmem, PP_SIGNATURE);
> >  
> >  	/* Ensuring all pages have been split into one fragment initially:
> >  	 * page_pool_set_pp_info() is only called once for every page when it
> > @@ -714,7 +720,13 @@ void page_pool_set_pp_info(struct page_pool *pool, netmem_ref netmem)
> >  
> >  void page_pool_clear_pp_info(netmem_ref netmem)
> >  {
> > -	netmem_clear_pp_magic(netmem);
> > +	/* For page-backed, pp_magic is used to identify if it's pp.
> > +	 * For net_iov, it's ensured nmdesc->pp is non-NULL if it's pp
> > +	 * and nmdesc->pp is NULL if it's not.
> > +	 */
> > +	if (!netmem_is_net_iov(netmem))
> > +		netmem_clear_pp_magic(netmem);
> > +
> >  	netmem_set_pp(netmem, NULL);
> >  }
> >  
> > 
> > base-commit: e1f5bb196f0b0eee197e06d361f8ac5f091c2963
> > -- 
> > 2.17.1