On 8/18/26 19:37, Mina Almasry wrote:
On Tue, Aug 18, 2026 at 3:26 AM Paolo Abeni [off-list ref] wrote:
...>> Note the mixing described in the second direction pre-dates this patch
quoted
(there was no check at all before); the incorrect predicate and the
forced re-segmentation are new. Reaching this also needs a local
privileged setup (dmabuf TX binding plus MD5/AO or IPsec plus an ethtool
feature change), and in that configuration a devmem send through the copy
path would likely already fail in skb_copy_to_page_nocache() since the
iovec holds dmabuf offsets rather than user addresses, so this is stated
as an observation rather than a demonstrated corruption path.
Pre-existing issue I think. We indeed assume binding != NULL means the
send is devmem and zc is set. We missed that we may not set zc if
NETIF_F_SG is not enabled. Probably the code setting binding to
Hmm, I flagged this one, I'm going to send out the diff I attached
in the thread for v3.
--
Pavel Begunkov