netdev - Re: [PATCH v4 09/12] io_uring/zcrx: reverse ifq refcount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e92c80f7-de26-4a06-a100-5947e6ccc739@gmail.com>
Date: Tue, 4 Nov 2025 13:38:00 +0000
From: Pavel Begunkov <asml.silence@...il.com>
To: David Wei <dw@...idwei.uk>, io-uring@...r.kernel.org,
 netdev@...r.kernel.org
Cc: Jens Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v4 09/12] io_uring/zcrx: reverse ifq refcount

On 11/3/25 23:41, David Wei wrote:
> Add two refcounts to struct io_zcrx_ifq to reverse the refcounting
> relationship i.e. rings now reference ifqs instead. As a result of this,

Note, you don't need the 2nd refcount in this patch as there is
only one io_uring using it. I hope not, but there is a chance
we might need to backport it, which is why it's midly preferably
to be kept separate.

> remove ctx->refs that an ifq holds on a ring via the page pool memory
> provider.

Nice!

> The first ref is ifq->refs, held by internal users of an ifq, namely
> rings and the page pool memory provider associated with an ifq. This is
> needed to keep the ifq around until the page pool is destroyed.
> 
> The second ref is ifq->user_refs, held by userspace facing users like
> rings. For now, only the ring that created the ifq will have a ref, but
> with ifq sharing added, this will include multiple rings.
> 
> ifq->refs will be 1 larger than ifq->user_refs, with the extra ref held

Can be larger than +1 as there might be multiple page pools
referring to it.

> by the page pool. Once ifq->user_refs falls to 0, the ifq is cleaned up
> including destroying the page pool. Once the page pool is destroyed,
> ifq->refs will fall to 0 and free the ifq.
-- 
Pavel Begunkov