Re: [PATCH net v2 1/2] page_pool: fix timing for checking and disabling napi_local

[Yunsheng Lin <linyunsheng@huawei.com>]

On 2024/10/9 23:13, Jakub Kicinski wrote:
> On Wed, 9 Oct 2024 11:33:02 +0800 Yunsheng Lin wrote:
>> Or I am missing something obvious here?
> 
> Seemingly the entire logic of how the safety of the lockless caching 
> is ensured.

I looked at it more closely, it seems what you meant ensuring is by setting
the napi->list_owner to -1 when disabling NAPI, right?

But letting skb_defer_free_flush() holding on the napi instance to check
the napi->list_owner without synchronizing with page_pool_destroy() seems
a little surprised to me, as page_pool_destroy() may return to driver to
free the napi even if it is a very very small time window, causing a
possible used-after-free problem?

          CPU 0                           CPU1
           .                               .
           .                   skb_defer_free_flush()
           .                               .
           .                  napi = READ_ONCE(pool->p.napi);
           .                               .
page_pool_disable_direct_recycling()       .
    driver free napi memory                .
           .                               .
           .              napi && READ_ONCE(napi->list_owner) == cpuid
           .                               .

> 
> But I don't think you don't trust my opinion so I'll let others explain
> this to you..