Re: [Intel-wired-lan] [PATCH net-next] ice: access @pp through netmem_desc instead of page

[Pavel Begunkov]

On 12/17/25 11:46, Loktionov, Aleksandr wrote:
> > -----Original Message-----
> > From: Intel-wired-lan <intel-wired-lan-bounces@xxxxxxxxxx> On Behalf
> > Of Byungchul Park
> > Sent: Tuesday, December 16, 2025 5:07 AM
> > To: netdev@xxxxxxxxxxxxxxx; kuba@xxxxxxxxxx
> > Cc: linux-kernel@xxxxxxxxxxxxxxx; kernel_team@xxxxxxxxxxx;
> > harry.yoo@xxxxxxxxxx; david@xxxxxxxxxx; willy@xxxxxxxxxxxxx;
> > toke@xxxxxxxxxx; asml.silence@xxxxxxxxx; almasrymina@xxxxxxxxxx;
> > Nguyen, Anthony L <anthony.l.nguyen@xxxxxxxxx>; Kitszel, Przemyslaw
> > <przemyslaw.kitszel@xxxxxxxxx>; andrew+netdev@xxxxxxx;
> > davem@xxxxxxxxxxxxx; edumazet@xxxxxxxxxx; pabeni@xxxxxxxxxx; intel-
> > wired-lan@xxxxxxxxxxxxxxxx
> > Subject: [Intel-wired-lan] [PATCH net-next] ice: access @pp through
> > netmem_desc instead of page
> >
> > To eliminate the use of struct page in page pool, the page pool users
> > should use netmem descriptor and APIs instead.
> >
> > Make ice driver access @pp through netmem_desc instead of page.
> Please add test info: HW/ASIC + PF/VF/SR-IOV, kernel version/branch, exact repro steps, before/after results (expected vs. observed).
>
> > Signed-off-by: Byungchul Park <byungchul@xxxxxx>
> > ---
> >   drivers/net/ethernet/intel/ice/ice_ethtool.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > index 969d4f8f9c02..ae8a4e35cb10 100644
> > --- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > +++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
> > @@ -1251,7 +1251,7 @@ static int ice_lbtest_receive_frames(struct
> > ice_rx_ring *rx_ring)
> >   		rx_buf = &rx_ring->rx_fqes[i];
> >   		page = __netmem_to_page(rx_buf->netmem);
> >   		received_buf = page_address(page) + rx_buf->offset +
> > -			       page->pp->p.offset;
> > +			       pp_page_to_nmdesc(page)->pp->p.offset;
> If rx_buf->netmem is not backed by a page pool (e.g., fallback allocation), pp will be NULL and this dereferences NULL.
> I think the loopback test runs in a controlled environment, but the code must verify pp is valid before dereferencing.
> Isn't it?

Considering "page->pp->p.offset" poking into the pool, if that can
happen it's a pre-existing problem, which should be fixed first.

--
Pavel Begunkov