linux-kernel - Re: [PATCH] 9p/virtio: restrict page pinning to user_backed

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aT-iwMpOfSoRzkTF@infradead.org>
Date: Sun, 14 Dec 2025 21:55:12 -0800
From: Christoph Hellwig <hch@...radead.org>
To: asmadeus@...ewreck.org
Cc: Christoph Hellwig <hch@...radead.org>,
	Eric Van Hensbergen <ericvh@...nel.org>,
	Latchesar Ionkov <lucho@...kov.net>,
	Christian Schoenebeck <linux_oss@...debyte.com>,
	v9fs@...ts.linux.dev, linux-kernel@...r.kernel.org,
	David Howells <dhowells@...hat.com>,
	Matthew Wilcox <willy@...radead.org>, linux-fsdevel@...r.kernel.org,
	Chris Arges <carges@...udflare.com>
Subject: Re: [PATCH] 9p/virtio: restrict page pinning to user_backed_iter()
 iovec

[Dave: netfs questions below, please read]

On Sat, Dec 13, 2025 at 10:28:50PM +0900, asmadeus@...ewreck.org wrote:
> Christoph Hellwig wrote on Wed, Dec 10, 2025 at 12:32:41AM -0800:
> > > Looking at the implementation for iov_iter_extract_bvec_pages() it looks
> > > like it might not process all the way to the end, so we need to loop on
> > > calling iov_iter_extract_pages()? (I see networking code looping on
> > > "while (iter->count > 0)")
> > 
> > Yes.
> 
> Ok, I don't understand why the current code locks everything down and
> wants to use a single scatterlist shared for the whole channel (and
> capped to 128 pages?), it should only need to lock around the
> virtqueue_add_sg() call, I'll need to play with that some more.

What do you mean with "lock down"?

> Looking at other virtio drivers I could probably use a sg_table and
> have extract_iter_to_sg() do all the work for us...

Looking at the code I'm actually really confused.  Both because I
actually though we were talking about the 9fs direct I/O code, but
that has actually been removed / converted to netfs a long time ago.

But even more so what the net/9p code is actually doing..  How do
we even end up with user addresses here at all?

Let me try to understand things:

 - p9_virtio_zc_request is the only instances of the p9_trans_module
   zc_request operation.
 - zc_request only gets called by p9_client_zc_rpc
 - p9_client_zc_rpc gets called by p9_client_read_once, p9_client_write,
   p9_client_write_subreq and p9_client_readdir

Let's go through these:

 - p9_client_write_subreq is entirely unused
 - p9_client_readdir builds a local iov_iter_kvec
 - p9_client_read_once is only called by p9_client_read, and really
   should be marked static.
 - p9_client_read is called by v9fs_issue_read on a netfs iov_iter
   and by v9fs_dir_readdir and v9fs_fid_xattr_get on a local kvec iter
 - p9_client_write is called with a iov_iter_kvec from
   v9fs_fid_xattr_set, and with a netfs-issued iov_iter by
   v9fs_issue_write
 
So right now except for netfs everything is on a kvec.  Dave, what
kind of iov_iter does netfs send down to the file system?  I had
a bit of a hard time reading through it, but I'd expect that any
page pinning would be done in netfs and not below it?  Why are we
using iov_iters here and not something like a bio_vec?  What is
the fs / transport supported to do with these iters?

Ignoring the rest of the mail for now, because I suspect the outcome
of the above might make it irrelevant, but I'll come back to it if
needed.