linux-kernel - Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp through netmem

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <39e285e0-81b7-47b2-b36f-50de7e51f95b@gmail.com>
Date: Wed, 17 Dec 2025 13:15:51 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>,
 Byungchul Park <byungchul@...com>,
 "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
 "kuba@...nel.org" <kuba@...nel.org>
Cc: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
 "kernel_team@...ynix.com" <kernel_team@...ynix.com>,
 "harry.yoo@...cle.com" <harry.yoo@...cle.com>,
 "david@...hat.com" <david@...hat.com>,
 "willy@...radead.org" <willy@...radead.org>,
 "toke@...hat.com" <toke@...hat.com>,
 "almasrymina@...gle.com" <almasrymina@...gle.com>,
 "Nguyen, Anthony L" <anthony.l.nguyen@...el.com>,
 "Kitszel, Przemyslaw" <przemyslaw.kitszel@...el.com>,
 "andrew+netdev@...n.ch" <andrew+netdev@...n.ch>,
 "davem@...emloft.net" <davem@...emloft.net>,
 "edumazet@...gle.com" <edumazet@...gle.com>,
 "pabeni@...hat.com" <pabeni@...hat.com>,
 "intel-wired-lan@...ts.osuosl.org" <intel-wired-lan@...ts.osuosl.org>
Subject: Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
 netmem_desc instead of page

On 12/17/25 11:46, Loktionov, Aleksandr wrote:
> 
> 
>> -----Original Message-----
>> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On Behalf
>> Of Byungchul Park
>> Sent: Tuesday, December 16, 2025 5:07 AM
>> To: netdev@...r.kernel.org; kuba@...nel.org
>> Cc: linux-kernel@...r.kernel.org; kernel_team@...ynix.com;
>> harry.yoo@...cle.com; david@...hat.com; willy@...radead.org;
>> toke@...hat.com; asml.silence@...il.com; almasrymina@...gle.com;
>> Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
>> <przemyslaw.kitszel@...el.com>; andrew+netdev@...n.ch;
>> davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; intel-
>> wired-lan@...ts.osuosl.org
>> Subject: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
>> netmem_desc instead of page
>>
>> To eliminate the use of struct page in page pool, the page pool users
>> should use netmem descriptor and APIs instead.
>>
>> Make ice driver access @pp through netmem_desc instead of page.
>>
> Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch, exact repro steps, before/after results (expected vs. observed).
> 
>> Signed-off-by: Byungchul Park <byungchul@...com>
>> ---
>>   drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c
>> b/drivers/net/ethernet/intel/ice/ice_ethtool.c
>> index 969d4f8f9c02..ae8a4e35cb10 100644
>> --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
>> +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
>> @@ -1251,7 +1251,7 @@ static int ice_lbtest_receive_frames(struct
>> ice_rx_ring *rx_ring)
>>   		rx_buf = &rx_ring->rx_fqes[i];
>>   		page = __netmem_to_page(rx_buf->netmem);
>>   		received_buf = page_address(page) + rx_buf->offset +
>> -			       page->pp->p.offset;
>> +			       pp_page_to_nmdesc(page)->pp->p.offset;
> If rx_buf->netmem is not backed by a page pool (e.g., fallback allocation), pp will be NULL and this dereferences NULL.
> I think the loopback test runs in a controlled environment, but the code must verify pp is valid before dereferencing.
> Isn't it?

Considering "page->pp->p.offset" poking into the pool, if that can
happen it's a pre-existing problem, which should be fixed first.

-- 
Pavel Begunkov