# Re: \[PATCH net v4 2/2\] net: tcp: block mixing readable and unreadable frags

- From: Pavel Begunkov \<asml.silence@gmail.com\>
- Date: 2026-08-22 10:55:27 
- List: netdev
- Page: https://ratatoskr.run/netdev/2026/08/17448234
- Thread: https://ratatoskr.run/netdev/2026/08/17414221/t.md

```text
On 8/18/26 19:37, Mina Almasry wrote:
> On Tue, Aug 18, 2026 at 3:26 AM Paolo Abeni [ref] wrote:
...>> Note the mixing described in the second direction pre-dates this patch
>> (there was no check at all before); the incorrect predicate and the
>> forced re-segmentation are new.  Reaching this also needs a local
>> privileged setup (dmabuf TX binding plus MD5/AO or IPsec plus an ethtool
>> feature change), and in that configuration a devmem send through the copy
>> path would likely already fail in skb_copy_to_page_nocache() since the
>> iovec holds dmabuf offsets rather than user addresses, so this is stated
>> as an observation rather than a demonstrated corruption path.
>
> Pre-existing issue I think. We indeed assume binding != NULL means the
> send is devmem and zc is set. We missed that we may not set zc if
> NETIF_F_SG is not enabled. Probably the code setting binding to

Hmm, I flagged this one, I'm going to send out the diff I attached
in the thread for v3.

-- 
Pavel Begunkov

```