[RFC 02/10] net: reject zcrx skbs to not registered devices
From: Pavel Begunkov <asml.silence@gmail.com>
Date: 2026-07-11 10:49:12
Also in:
io-uring
Subsystem:
io_uring, io_uring zcrx, networking [general], the rest · Maintainers:
Jens Axboe, Pavel Begunkov, "David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, Linus Torvalds
Tx of netmems that weren't created for the targeted device should be rejected. Devmem TCP does it by looking up the net device in devmem TCP private strucures. Introduce a netdev pointer in struct net_iov_area and set it for zcrx so that we can check it in a more generic way. Keep the existing devmem TCP path for the RFC version of the patch. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> --- include/net/netmem.h | 1 + io_uring/zcrx.c | 3 +++ net/core/dev.c | 10 ++++++++-- 3 files changed, 12 insertions(+), 2 deletions(-)
diff --git a/include/net/netmem.h b/include/net/netmem.h
index bccacd21b6c3..71024c7ce884 100644
--- a/include/net/netmem.h
+++ b/include/net/netmem.h@@ -103,6 +103,7 @@ struct net_iov_area { struct net_iov *niovs; size_t num_niovs; + struct net_device *netdev; /* Offset into the dma-buf where this chunk starts. */ unsigned long base_virtual; };
diff --git a/io_uring/zcrx.c b/io_uring/zcrx.c
index 7ad52f499f87..ef82e064e796 100644
--- a/io_uring/zcrx.c
+++ b/io_uring/zcrx.c@@ -516,6 +516,7 @@ static int io_zcrx_create_area(struct io_zcrx_ifq *ifq, goto err; } + area->nia.netdev = ifq->netdev; area->free_count = nr_iovs; /* we're only supporting one area per ifq for now */ area->area_id = 0;
@@ -554,6 +555,7 @@ static void io_zcrx_drop_netdev(struct io_zcrx_ifq *ifq) if (!ifq->netdev) return; + WRITE_ONCE(ifq->area->nia.netdev, NULL); netdev_put(ifq->netdev, &ifq->netdev_tracker); ifq->netdev = NULL; }
@@ -568,6 +570,7 @@ static void io_close_queue(struct io_zcrx_ifq *ifq) }; scoped_guard(mutex, &ifq->pp_lock) { + WRITE_ONCE(ifq->area->nia.netdev, NULL); netdev = ifq->netdev; netdev_tracker = ifq->netdev_tracker; ifq->netdev = NULL;
diff --git a/net/core/dev.c b/net/core/dev.c
index 4b3d5cfdf6e0..703b55778c32 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c@@ -4004,9 +4004,15 @@ static struct sk_buff *validate_xmit_unreadable_skb(struct sk_buff *skb, shinfo = skb_shinfo(skb); if (shinfo->nr_frags > 0) { + struct net_device *trgt_dev; + niov = netmem_to_net_iov(skb_frag_netmem(&shinfo->frags[0])); - if (net_is_devmem_iov(niov) && - READ_ONCE(net_devmem_iov_binding(niov)->dev) != dev) + if (net_is_devmem_iov(niov)) + trgt_dev = READ_ONCE(net_devmem_iov_binding(niov)->dev); + else + trgt_dev = READ_ONCE(net_iov_owner(niov)->netdev); + + if (trgt_dev != dev) goto out_free; }
--
2.54.0