Re: [PATCH] net: skmsg: fix copy cursor when coalescing clones

[Alexei Starovoitov]

On Thu, Oct 29, 2026 at 9:22 PM Kyle Zeng <kylebot@xxxxxxxxxx> wrote:
>
> A splice or zero-copy append can leave the destination copy cursor at
> sg.end. If sk_msg_clone() subsequently coalesces with the last entry,
> sg.end does not advance and the cursor still points at an unused slot.
> sk_msg_memcopy_from_iter() can then walk around the ring and write into
> older entries, including file pages spliced from a read-only descriptor.
>
> Software TLS can reach this with an ordinary MSG_MORE send after a file
> splice and a splice from another TCP socket. Both TCP and the TLS
> encrypted-message allocation can use the sending task's page fragment,
> so the TCP-sourced plaintext can be contiguous with the next cloned
> encrypted-message range.
>
> When coalescing with an exhausted destination, move the copy cursor to
> the tail and set copybreak to its old length before extending it. Find
> the actual tail on each iteration using the ring iterator, including
> when end wraps to zero. Leave an existing copy cursor unchanged and
> preserve the normal coalescing, reference counting, and memory charging.
>
> Fixes: fda497e5f5b8 ("Optimize sk_msg_clone() by data merge to end dst sg entry")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Kyle Zeng <kylebot@xxxxxxxxxx>

pls respin and target bpf tree.

pw-bot: cr