Re: [PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Mina Almasry]

On Wed, Oct 21, 2026 at 8:17 AM Pavel Begunkov <asml.silence@xxxxxxxxx> wrote:
>
> On 10/19/26 18:45, Kaifeng Wang wrote:
> > tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
> > zero-copy path is active and a valid dmabuf binding exists. However,
> > subsequent branches in tcp_sendmsg_locked() can still intercept the
> > message before it reaches the devmem zero-copy loop:
> >
> > 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
> >     If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
> >     NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
> >     tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
> >     copy_page_from_iter() to byte-copy from the iterator. Since iov_base
> >     represents dma-buf offsets rather than user virtual addresses, this
> >     misinterprets offsets as user pointers and copies the caller's memory
> >     at those addresses into the SYN packet.
> >
> > 2. TCP repair mode:
> >     If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
> >     calls skb_copy_datagram_from_iter(), byte-copying from the iterator.
> >
> > Neither path supports or makes sense for devmem transmission. Reject
> > devmem sends inside the Fast Open and TCP repair branches when a devmem
> > binding is present. Checking inside the tp->repair branch also covers
> > the case where repair mode is enabled while sk_stream_wait_connect()
> > drops the socket lock.
> >
> > Additionally, drop the !sockc_err gate from the devmem validation check
> > and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
> > followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
> > not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
> > proceed and return before sockc_err is checked.
> >
> > This pre-existing issue was identified by Sashiko AI review on commit
> > 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
> > hit in production.
> >
> > Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
> > Fixes: bd61848900bf ("net: devmem: Implement TX path")
> > Reviewed-by: Mina Almasry <almasrymina@xxxxxxxxxx>
> > Signed-off-by: Kaifeng Wang <kaifengw@xxxxxxxxxx>
> > ---
> > v1 -> v2:
> > - Move the devmem rejection checks into the Fast Open and TCP repair
> >    branches directly, also covering the case where tp->repair is enabled
> >    while sk_stream_wait_connect() drops the socket lock.
> > - Drop the !sockc_err gate from the devmem validation check and return
> >    sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
> >    failing cmsg from bypassing the check.
> >
> >   net/ipv4/tcp.c | 12 ++++++++++--
> >   1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> > index 87ef6d5cbfeb..2792923f0748 100644
> > --- a/net/ipv4/tcp.c
> > +++ b/net/ipv4/tcp.c
> > @@ -1169,14 +1169,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
> >                       zc = MSG_SPLICE_PAGES;
> >       }
> >
> > -     if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> > -             err = -EINVAL;
> > +     if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
>
> I wonder why it does sockc_err checks like that for devmem, e.g. instead of
> failing earlier. Maybe Mina remembers?

IIRC, Paolo caught an issue where we were subtely changing behavior.
Like if someone passes in a bad sockc flags, it's usually ignored, but
if we process the sockc_err before we need it for devmem we change
behavior for existing users that were passing bad sockc but not using
devmem.

-- 
Thanks,
Mina