From: Jakub Kicinski <kuba@kernel.org>
To: Mina Almasry <almasrymina@google.com>
Cc: Jijie Shao <shaojijie@huawei.com>,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
andrew+netdev@lunn.ch, horms@kernel.org, hawk@kernel.org,
ilias.apalodimas@linaro.org, toke@redhat.com,
shenjian15@huawei.com, liuyonglong@huawei.com,
chenhao418@huawei.com, yangshuaisong@h-partners.com,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v4 net] net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race
Date: Tue, 4 Aug 2026 19:16:28 -0700 [thread overview]
Message-ID: <20260804191628.762ec7eb@kernel.org> (raw)
In-Reply-To: <CAHS8izPpwz=swSXJZhnVFvTeu43WBhtRv7PmC_OQ0XzG8no8bQ@mail.gmail.com>
On Fri, 31 Jul 2026 10:37:58 -0700 Mina Almasry wrote:
> > + __page_pool_unmap_netmem_dma(pool, netmem);
> > page_pool_set_dma_addr_netmem(netmem, 0);
> > + if (likely(PP_DMA_INDEX_BITS))
> > + netmem_set_dma_index(netmem, 0);
>
> I now notice that maybe another cleanup we could have done is open
> code __page_pool_unmap_netmem_dma() in this function to cut down 1
> helper, and just have the scrub function call
> __page_pool_release_netmem_dma() to reduce some code. But this is more
> than fine too I think, especially since this is a fix the stable trees
> are going to want I guess.
Not sure this is a good idea? scrub is trying to touch just the DMA
mapping, right? It shouldn't try to update the page itself because
it has no reference to the page, the page may get freed in parallel.
Hopefully DMA unmap on a freed page is legal..
next prev parent reply other threads:[~2026-08-05 2:16 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-31 11:15 [PATCH v4 net] net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race Jijie Shao
2026-07-31 17:37 ` Mina Almasry
2026-08-05 2:16 ` Jakub Kicinski [this message]
2026-08-05 3:50 ` Mina Almasry
2026-08-05 8:10 ` Jijie Shao
2026-08-05 2:17 ` Jakub Kicinski
2026-08-05 8:21 ` Jijie Shao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260804191628.762ec7eb@kernel.org \
--to=kuba@kernel.org \
--cc=almasrymina@google.com \
--cc=andrew+netdev@lunn.ch \
--cc=chenhao418@huawei.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=hawk@kernel.org \
--cc=horms@kernel.org \
--cc=ilias.apalodimas@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=liuyonglong@huawei.com \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=shaojijie@huawei.com \
--cc=shenjian15@huawei.com \
--cc=toke@redhat.com \
--cc=yangshuaisong@h-partners.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox