Re: [PATCH net v4 2/2] net: tcp: block mixing readable and unreadable frags

On 8/18/26 19:37, Mina Almasry wrote:

On Tue, Aug 18, 2026 at 3:26 AM Paolo Abeni [off-list ref] wrote:

...>> Note the mixing described in the second direction pre-dates this patch

quoted

(there was no check at all before); the incorrect predicate and the
forced re-segmentation are new.  Reaching this also needs a local
privileged setup (dmabuf TX binding plus MD5/AO or IPsec plus an ethtool
feature change), and in that configuration a devmem send through the copy
path would likely already fail in skb_copy_to_page_nocache() since the
iovec holds dmabuf offsets rather than user addresses, so this is stated
as an observation rather than a demonstrated corruption path.

Pre-existing issue I think. We indeed assume binding != NULL means the
send is devmem and zc is set. We missed that we may not set zc if
NETIF_F_SG is not enabled. Probably the code setting binding to

Hmm, I flagged this one, I'm going to send out the diff I attached
in the thread for v3.

-- 
Pavel Begunkov