Re: [PATCH net v4 2/2] net: tcp: block mixing readable and unreadable frags

[Pavel Begunkov]

On 8/18/26 19:37, Mina Almasry wrote:
> On Tue, Aug 18, 2026 at 3:26 AM Paolo Abeni <pabeni@xxxxxxxxxx> wrote:
...>> Note the mixing described in the second direction pre-dates this patch
> > (there was no check at all before); the incorrect predicate and the
> > forced re-segmentation are new.  Reaching this also needs a local
> > privileged setup (dmabuf TX binding plus MD5/AO or IPsec plus an ethtool
> > feature change), and in that configuration a devmem send through the copy
> > path would likely already fail in skb_copy_to_page_nocache() since the
> > iovec holds dmabuf offsets rather than user addresses, so this is stated
> > as an observation rather than a demonstrated corruption path.
>
> Pre-existing issue I think. We indeed assume binding != NULL means the
> send is devmem and zc is set. We missed that we may not set zc if
> NETIF_F_SG is not enabled. Probably the code setting binding to

Hmm, I flagged this one, I'm going to send out the diff I attached
in the thread for v3.

--
Pavel Begunkov