netdev - [PATCH v2 4/5] io_uring/zcrx: redirect io

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251025191504.3024224-5-dw@davidwei.uk>
Date: Sat, 25 Oct 2025 12:15:03 -0700
From: David Wei <dw@...idwei.uk>
To: io-uring@...r.kernel.org,
	netdev@...r.kernel.org
Cc: Jens Axboe <axboe@...nel.dk>,
	Pavel Begunkov <asml.silence@...il.com>
Subject: [PATCH v2 4/5] io_uring/zcrx: redirect io_recvzc on proxy ifq to src ifq

Technically there is no reason why one ring can't issue io_recvzc on a
socket that is steered into a zero copy HW RX queue bound to an ifq in
another ring. No ifq locks are taken in the happy zero copy path; only
socket locks. If copy fallback is needed the freelist spinlock is taken,
which ensures multiple contexts can synchronise access.

Writing to the tail of the refill ring needs to be synchronised, though
that can be done purely from userspace.

The only thing preventing this today is a check in io_zcrx_recv_frag()
that returns EFAULT if the ifq of the net_iov in an skb doesn't match.
This is the ifq that owns the memory provider bound to a HW RX queue.

The previous patches added a proxy ifq that has a ptr to the src ifq.
Therefore to pass this check, use the src ifq in io_recvzc.

Signed-off-by: David Wei <dw@...idwei.uk>
---
 io_uring/net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/io_uring/net.c b/io_uring/net.c
index a95cc9ca2a4d..8eb6145e0f4d 100644
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1250,6 +1250,8 @@ int io_recvzc_prep(struct io_kiocb *req, const struct io_uring_sqe *sqe)
 	zc->ifq = xa_load(&req->ctx->zcrx_ctxs, ifq_idx);
 	if (!zc->ifq)
 		return -EINVAL;
+	if (zc->ifq->proxy)
+		zc->ifq = zc->ifq->proxy;

 	zc->len = READ_ONCE(sqe->len);
 	zc->flags = READ_ONCE(sqe->ioprio);
-- 
2.47.3