Message-ID: <IA3PR11MB898609A6FA1E75B5C87C27C2E5ABA@IA3PR11MB8986.namprd11.prod.outlook.com>
Date: Wed, 17 Dec 2025 14:34:14 +0000
From: "Loktionov, Aleksandr" <aleksandr.loktionov@...el.com>
To: Pavel Begunkov <asml.silence@...il.com>, Byungchul Park
	<byungchul@...com>, "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"kuba@...nel.org" <kuba@...nel.org>
CC: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"kernel_team@...ynix.com" <kernel_team@...ynix.com>, "harry.yoo@...cle.com"
	<harry.yoo@...cle.com>, "david@...hat.com" <david@...hat.com>,
	"willy@...radead.org" <willy@...radead.org>, "toke@...hat.com"
	<toke@...hat.com>, "almasrymina@...gle.com" <almasrymina@...gle.com>,
	"Nguyen, Anthony L" <anthony.l.nguyen@...el.com>, "Kitszel, Przemyslaw"
	<przemyslaw.kitszel@...el.com>, "andrew+netdev@...n.ch"
	<andrew+netdev@...n.ch>, "davem@...emloft.net" <davem@...emloft.net>,
	"edumazet@...gle.com" <edumazet@...gle.com>, "pabeni@...hat.com"
	<pabeni@...hat.com>, "intel-wired-lan@...ts.osuosl.org"
	<intel-wired-lan@...ts.osuosl.org>
Subject: RE: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
 netmem_desc instead of page



> -----Original Message-----
> From: Pavel Begunkov <asml.silence@...il.com>
> Sent: Wednesday, December 17, 2025 2:16 PM
> To: Loktionov, Aleksandr <aleksandr.loktionov@...el.com>; Byungchul
> Park <byungchul@...com>; netdev@...r.kernel.org; kuba@...nel.org
> Cc: linux-kernel@...r.kernel.org; kernel_team@...ynix.com;
> harry.yoo@...cle.com; david@...hat.com; willy@...radead.org;
> toke@...hat.com; almasrymina@...gle.com; Nguyen, Anthony L
> <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
> <przemyslaw.kitszel@...el.com>; andrew+netdev@...n.ch;
> davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; intel-
> wired-lan@...ts.osuosl.org
> Subject: Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp
> through netmem_desc instead of page
> 
> On 12/17/25 11:46, Loktionov, Aleksandr wrote:
> >
> >
> >> -----Original Message-----
> >> From: Intel-wired-lan <intel-wired-lan-bounces@...osl.org> On
> Behalf
> >> Of Byungchul Park
> >> Sent: Tuesday, December 16, 2025 5:07 AM
> >> To: netdev@...r.kernel.org; kuba@...nel.org
> >> Cc: linux-kernel@...r.kernel.org; kernel_team@...ynix.com;
> >> harry.yoo@...cle.com; david@...hat.com; willy@...radead.org;
> >> toke@...hat.com; asml.silence@...il.com; almasrymina@...gle.com;
> >> Nguyen, Anthony L <anthony.l.nguyen@...el.com>; Kitszel, Przemyslaw
> >> <przemyslaw.kitszel@...el.com>; andrew+netdev@...n.ch;
> >> davem@...emloft.net; edumazet@...gle.com; pabeni@...hat.com; intel-
> >> wired-lan@...ts.osuosl.org
> >> Subject: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
> >> netmem_desc instead of page
> >>
> >> To eliminate the use of struct page in page pool, the page pool
> users
> >> should use netmem descriptor and APIs instead.
> >>
> >> Make ice driver access @pp through netmem_desc instead of page.
> >>
> > Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch,
> exact repro steps, before/after results (expected vs. observed).
> >
> >> Signed-off-by: Byungchul Park <byungchul@...com>
> >> ---
> >>   drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +-
> >>   1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> >> b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> >> index 969d4f8f9c02..ae8a4e35cb10 100644
> >> --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> >> +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> >> @@ -1251,7 +1251,7 @@ static int ice_lbtest_receive_frames(struct
> >> ice_rx_ring *rx_ring)
> >>   		rx_buf = &rx_ring->rx_fqes[i];
> >>   		page = __netmem_to_page(rx_buf->netmem);
> >>   		received_buf = page_address(page) + rx_buf->offset +
> >> -			       page->pp->p.offset;
> >> +			       pp_page_to_nmdesc(page)->pp->p.offset;
> > If rx_buf->netmem is not backed by a page pool (e.g., fallback
> allocation), pp will be NULL and this dereferences NULL.
> > I think the loopback test runs in a controlled environment, but the
> code must verify pp is valid before dereferencing.
> > Isn't it?
> 
> Considering "page->pp->p.offset" poking into the pool, if that can
> happen it's a pre-existing problem, which should be fixed first.
> 
> --
> Pavel Begunkov


Good day, Hi Byungchul, Pavel,

Thanks for pushing the driver toward netmem — I fully support removing direct struct page accesses from the networking stack.

Regarding this change in ice_lbtest_receive_frames():

	received_buf = page_address(page) + rx_buf->offset +
		pp_page_to_nmdesc(page)->pp->p.offset;

Pavel, you're right that if page->pp could be NULL, it's a pre-existing bug that should be fixed.
However, looking at the loopback test path, I'm concerned this code doesn't handle non-page-pool allocations safely.

The netmem model explicitly allows for buffers that aren't page-pool backed.
While the loopback test likely runs in a controlled environment, the code should verify pp is valid before dereferencing,
or use the netmem helpers that handle this gracefully:

	struct netmem_desc *ndesc = __netmem_to_nmdesc(rx_buf->netmem);
	void *addr = netmem_address(rx_buf->netmem);
	struct page_pool *pp;

	if (!addr)
		continue; /* unreadable netmem */

	pp = __netmem_get_pp(ndesc);
	received_buf = addr + rx_buf->offset + (pp ? pp->p.offset : 0);

Alternatively, guard the existing code with page_pool_page_is_pp(page) before calling pp_page_to_nmdesc().

This would complete the netmem conversion while fixing the unsafe dereference,
aligning with Matthew's earlier suggestion to use descriptor/address accessors.

Also, please add test details to the commit message:

HW/ASIC (e.g., E810/E823)
PF vs VF, SR-IOV configuration
Kernel tree/commit (net-next @ <sha>)
Repro steps: ethtool -t $dev offline
Before/after behavior
Happy to review v2 with these changes.

Best regards,
Alex

Powered by blists - more mailing lists