crypto: af_alg: where should writable ownership be enforced for MSG_SPLICE_PAGES?

Hi,

I am studying the AF_ALG MSG_SPLICE_PAGES path and would like to ask where writable ownership is expected to be enforced for scatterlists used as AEAD destinations.

The path I am looking at is roughly:

        pipe_buffer
          -> bio_vec / iov_iter_bvec
          -> AF_ALG TX scatterlist
          -> AF_ALG RX/DST scatterlist
          -> AEAD implementation

In the MSG_SPLICE_PAGES case, AF_ALG can import page references into the TX scatterlist through extract_iter_to_sg(). During AEAD recvmsg decryption, some data is copied into the RX scatterlist, while some TX scatterlist entries may be reassigned or chained into the request scatterlist used for the operation.

What I am trying to understand is the intended ownership rule here. A scatterlist entry describes a page extent, but it does not seem to say whether that page is safe to use as an in-place write destination.

For example, if an entry ultimately refers to a borrowed file page-cache page, then an AEAD implementation that writes to the destination scatterlist would need that page to have been copied or COWed first.

Is the intended invariant something like the following?

Pages reachable from an AEAD destination scatterlist must be writable by the crypto operation, and borrowed file page-cache references must be copied before they can appear there.

If so, where would maintainers prefer this to be enforced?

1. in AF_ALG when constructing or chaining the RX/DST scatterlist,
2. in the MSG_SPLICE_PAGES import path,
3. in individual AEAD implementations before in-place writes,
4. or somewhere else?

I am asking before preparing an RFC patch because I would like to avoid proposing metadata or API changes in the wrong layer.

Thanks,
Kenneth Lee