On Tue, Apr 22, 2025 at 1:43 AM Pavel Begunkov asml.silence@gmail.com wrote:
On 4/18/25 00:15, Mina Almasry wrote:
Currently net_iovs support only pp ref counts, and do not support a page ref equivalent.
Makes me wonder why it's needed. In theory, nobody should ever be taking page references without going through struct ubuf_info handling first, all in kernel users of these pages should always be paired with ubuf_info, as it's user memory, it's not stable, and without ubuf_info the user is allowed to overwrite it.
The concern about the stability of the from-userspace data is already called out in the MSG_ZEROCOPY documentation that we're piggybacking devmem TX onto:
https://www.kernel.org/doc/html/v4.15/networking/msg_zerocopy.html
Basically the userspace passes the memory to the kernel and waits for a notification for when it's safe to reuse/overwrite the data. I don't know that it's a security concern. Basically if the userspace modifies the data before it gets the notification from the kernel, then it will mess up its own TX. The notification is sent by the kernel to the userspace when the skb is freed I believe, at that point it's safe to reuse the buffer as the kernel no longer needs it for TX.
For devmem we do need to pin the binding until all TX users are done with it, so get_netmem will increase the refcount on the binding to keep it alive until the net stack is done with it.
Maybe there are some gray area cases like packet inspection or tracing? However in this case, after the ubuf_info is dropped, the user can overwrite the memory with its secrets. Definitely iffy in security terms.
You can look at all the callers of skb_frag_ref to see all the code paths that grab a page ref on the frag today. There is also an inspection by me in the v5 changelog.