This series fixes the late dma_unmap crash for page pool first reported by Yonglong Liu in [0]. It is an alternative approach to the one submitted by Yunsheng Lin, most recently in [1]. The first commit just wraps some tests in a helper function, in preparation of the main change in patch 2. See the commit message of patch 2 for the details. -Toke [0] https://lore.kernel.org/lkml/8067f204-1380-4d37-8ffd-007fc6f26738@xxxxxxxxxx/T/ [1] https://lore.kernel.org/r/20250307092356.638242-1-linyunsheng@xxxxxxxxxx Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx> --- Changes in v9: - Remove empty lines left over in patch 1 - Link to v8: https://lore.kernel.org/r/20250407-page-pool-track-dma-v8-0-da9500d4ba21@xxxxxxxxxx Changes in v8: - Move defines to mm.h - Keep pp->dma_sync as 1-bit wide - Unset pp->dma_addr on id alloc failure - Rebase on -rc1 - Link to v7: https://lore.kernel.org/r/20250404-page-pool-track-dma-v7-0-ad34f069bc18@xxxxxxxxxx Changes in v7: - Change WARN_ON logic if xarray alloc fails - Don't leak xarray ID if page_pool_set_dma_addr_netmem() fails - Unconditionally init xarray in page_pool_init() - Rebase on current net-next - Link to v6: https://lore.kernel.org/r/20250401-page-pool-track-dma-v6-0-8b83474870d4@xxxxxxxxxx Changes in v6: - Add READ_ONCE() around both reads of pp->dma_sync - Link to v5: https://lore.kernel.org/r/20250328-page-pool-track-dma-v5-0-55002af683ad@xxxxxxxxxx Changes in v5: - Dereferencing pp->p.dev if pp->pma_sync is unset could lead to a crash, so make sure we don't do that. - With the change above, patch 2 was just changing a single field, so squash it into patch 3 - Link to v4: https://lore.kernel.org/r/20250327-page-pool-track-dma-v4-0-b380dc6706d0@xxxxxxxxxx Changes in v4: - Rebase on net-next - Collect tags - Link to v3: https://lore.kernel.org/r/20250326-page-pool-track-dma-v3-0-8e464016e0ac@xxxxxxxxxx Changes in v3: - Use a full-width bool for pp->dma_sync instead of a full unsigned long (in patch 2), and leave pp->dma_sync_cpu alone. - Link to v2: https://lore.kernel.org/r/20250325-page-pool-track-dma-v2-0-113ebc1946f3@xxxxxxxxxx Changes in v2: - Always leave two bits at the top of pp_magic as zero, instead of one - Add an rcu_read_lock() around __page_pool_dma_sync_for_device() - Add a comment in poison.h with a reference to the bitmask definition - Add a longer description of the logic of the bitmask definitions to the comment in types.h, and a summary of the security implications of using the pp_magic field to the commit message of patch 3 - Collect Mina's Reviewed-by and Yonglong's Tested-by tags - Link to v1: https://lore.kernel.org/r/20250314-page-pool-track-dma-v1-0-c212e57a74c2@xxxxxxxxxx --- Toke Høiland-Jørgensen (2): page_pool: Move pp_magic check into helper functions page_pool: Track DMA-mapped pages and unmap them when destroying the pool drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +- include/linux/mm.h | 58 +++++++++++++++++ include/linux/poison.h | 4 ++ include/net/page_pool/types.h | 6 ++ mm/page_alloc.c | 8 +-- net/core/netmem_priv.h | 33 +++++++++- net/core/page_pool.c | 81 ++++++++++++++++++++---- net/core/skbuff.c | 16 +---- net/core/xdp.c | 4 +- 9 files changed, 176 insertions(+), 38 deletions(-) --- base-commit: 420aabef3ab5fa743afb4d3d391f03ef0e777ca8 change-id: 20250310-page-pool-track-dma-0332343a460e
