[PATCH 7.1 216/271] net: devmem: prevent net-iov / page mixing

7.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Pavel Begunkov <[email protected]>

commit 53a43508ee332d8bffe40590c3d189c92a551f9f upstream.

We should either have net_iov or page backed frags in a single skb,
otherwise it blows up down the stack. Don't allow mixing in
zerocopy_fill_skb_from_devmem().

Fixes: bd61848900bff ("net: devmem: Implement TX path")
Cc: [email protected]
Signed-off-by: Pavel Begunkov <[email protected]>
Acked-by: Stanislav Fomichev <[email protected]>
Reviewed-by: Mina Almasry <[email protected]>
Reviewed-by: Bobby Eshleman <[email protected]>
Link: https://patch.msgid.link/e3199788c4732545627a4721097ebb71ad737bab.1785150502.git.asml.silence@gmail.com
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
 net/core/datagram.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -712,6 +712,9 @@ zerocopy_fill_skb_from_devmem(struct sk_
 	size_t virt_addr, size, off;
 	struct net_iov *niov;
 
+	if (i && skb_frags_readable(skb))
+		return -EFAULT;
+
 	/* Devmem filling works by taking an IOVEC from the user where the
 	 * iov_addrs are interpreted as an offset in bytes into the dma-buf to
 	 * send from. We do not support other iter types.