Re: [PATCH net v4 2/2] net: tcp: block mixing readable and unreadable frags

On 8/18/26 19:37, Mina Almasry wrote:
> On Tue, Aug 18, 2026 at 3:26 AM Paolo Abeni <[email protected]> wrote:
...>> Note the mixing described in the second direction pre-dates this patch
>> (there was no check at all before); the incorrect predicate and the
>> forced re-segmentation are new.  Reaching this also needs a local
>> privileged setup (dmabuf TX binding plus MD5/AO or IPsec plus an ethtool
>> feature change), and in that configuration a devmem send through the copy
>> path would likely already fail in skb_copy_to_page_nocache() since the
>> iovec holds dmabuf offsets rather than user addresses, so this is stated
>> as an observation rather than a demonstrated corruption path.
> 
> Pre-existing issue I think. We indeed assume binding != NULL means the
> send is devmem and zc is set. We missed that we may not set zc if
> NETIF_F_SG is not enabled. Probably the code setting binding to

Hmm, I flagged this one, I'm going to send out the diff I attached
in the thread for v3.

-- 
Pavel Begunkov