Virtualization - May 2023 - [PATCH net-next 1/5] virtio_net: Fix an unsafe reference to the page chain

On Fri, May 26, 2023 at 1:46?PM Liang Chen <liangchen.linux at gmail.com>
wrote:
>
> "private" of buffer page is currently used for big mode to chain
pages.
> But in mergeable mode, that offset of page could mean something else,
> e.g. when page_pool page is used instead. So excluding mergeable mode to
> avoid such a problem.
If this issue happens only in the case of page_pool, it would be
better to squash it there.

Thanks
>
> Signed-off-by: Liang Chen <liangchen.linux at gmail.com>
> ---
>  drivers/net/virtio_net.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index 5a7f7a76b920..c5dca0d92e64 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -497,7 +497,7 @@ static struct sk_buff *page_to_skb(struct virtnet_info
*vi,
>                         return NULL;
>
>                 page = (struct page *)page->private;
> -               if (page)
> +               if (!vi->mergeable_rx_bufs && page)
>                         give_pages(rq, page);
>                 goto ok;
>         }
> --
> 2.31.1
>

On Fri, May 26, 2023 at 2:39?PM Jason Wang <jasowang at redhat.com>
wrote:
>
> On Fri, May 26, 2023 at 1:46?PM Liang Chen <liangchen.linux at
gmail.com> wrote:
> >
> > "private" of buffer page is currently used for big mode to
chain pages.
> > But in mergeable mode, that offset of page could mean something else,
> > e.g. when page_pool page is used instead. So excluding mergeable mode
to
> > avoid such a problem.
>
> If this issue happens only in the case of page_pool, it would be
> better to squash it there.
>
> Thanks
Sure, thanks!

>
> >
> > Signed-off-by: Liang Chen <liangchen.linux at gmail.com>
> > ---
> >  drivers/net/virtio_net.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 5a7f7a76b920..c5dca0d92e64 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -497,7 +497,7 @@ static struct sk_buff *page_to_skb(struct
virtnet_info *vi,
> >                         return NULL;
> >
> >                 page = (struct page *)page->private;
> > -               if (page)
> > +               if (!vi->mergeable_rx_bufs && page)
> >                         give_pages(rq, page);
> >                 goto ok;
> >         }
> > --
> > 2.31.1
> >
>

On Fri, May 26, 2023 at 02:38:54PM +0800, Jason Wang
wrote:
> On Fri, May 26, 2023 at 1:46?PM Liang Chen <liangchen.linux at
gmail.com> wrote:
> >
> > "private" of buffer page is currently used for big mode to
chain pages.
> > But in mergeable mode, that offset of page could mean something else,
> > e.g. when page_pool page is used instead. So excluding mergeable mode
to
> > avoid such a problem.
> 
> If this issue happens only in the case of page_pool, it would be
> better to squash it there.
> 
> Thanks

This is a tiny patch so I don't care. Generally it's ok
to first rework code then change functionality.
in this case what Jason says os right especially because
you then do not need to explain that current code is ok.
> >
> > Signed-off-by: Liang Chen <liangchen.linux at gmail.com>
> > ---
> >  drivers/net/virtio_net.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> > index 5a7f7a76b920..c5dca0d92e64 100644
> > --- a/drivers/net/virtio_net.c
> > +++ b/drivers/net/virtio_net.c
> > @@ -497,7 +497,7 @@ static struct sk_buff *page_to_skb(struct
virtnet_info *vi,
> >                         return NULL;
> >
> >                 page = (struct page *)page->private;
> > -               if (page)
> > +               if (!vi->mergeable_rx_bufs && page)
> >                         give_pages(rq, page);
> >                 goto ok;
> >         }
> > --
> > 2.31.1
> >