Re: [PATCH v4 net] net: page_pool: fix UAF in __page_pool_release_netmem_dma on xa_cmpxchg race

[Jakub Kicinski]

On Fri, 31 Jul 2026 10:37:58 -0700 Mina Almasry wrote:
> > +       __page_pool_unmap_netmem_dma(pool, netmem);
> >         page_pool_set_dma_addr_netmem(netmem, 0);
> > +       if (likely(PP_DMA_INDEX_BITS))
> > +               netmem_set_dma_index(netmem, 0);  
> 
> I now notice that maybe another cleanup we could have done is open
> code __page_pool_unmap_netmem_dma() in this function to cut down 1
> helper, and just have the scrub function call
> __page_pool_release_netmem_dma() to reduce some code. But this is more
> than fine too I think, especially since this is a fix the stable trees
> are going to want I guess.

Not sure this is a good idea? scrub is trying to touch just the DMA
mapping, right? It shouldn't try to update the page itself because
it has no reference to the page, the page may get freed in parallel.
Hopefully DMA unmap on a freed page is legal..