Re: [PATCH net-next v3 1/2] net: netmem: document netmem and memory provider design in comments

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: skb_try_coalesce() allows mixing fragments from different memory providers
--

commit e4f91f2e0cb9de813eeecc8b5549e79dc322d463
Author: Mina Almasry <almasrymina@google.com>

net: netmem: document netmem and memory provider design in comments

Clarify the netmem, memory provider, page_pool, and skb fragment design
principles in header and code comments. It documents that all frags in an
skb must either all be struct page-backed or all belong to the same memory
provider instance, and adds a check in skb_try_coalesce() to enforce this.

Link: https://lore.kernel.org/netdev/20261008023030.1089616-1-almasrymina@google.com/
Link: https://lore.kernel.org/netdev/20261005004958.3603059-1-almasrymina@google.com/

> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index d56f4f0102f75..69d3d27e29d97 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c

[ ... ]

> @@ -6210,6 +6210,10 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
>  	if (to->pp_recycle != from->pp_recycle)
>  		return false;
>  
> +	/* All frags in an skb must either all be struct page-backed or all
> +	 * belong to the same memory provider instance; do not coalesce skbs
> +	 * that would mix them.
> +	 */
> +	if (skb_frags_readable(from) != skb_frags_readable(to))
> +		return false;

[Severity: High]
Does this check reliably prevent mixing fragments from different memory
providers?

If a socket receives packets from multiple RX queues (e.g., via RPS/RFS or
multipath) where one queue is bound to a devmem provider and another to an
io_uring provider, both packets will have skb_frags_readable == false. This
condition then evaluates to false != false and allows skb_try_coalesce() to
successfully merge them into a single SKB.

If this coalesced SKB is processed by the TCP receive path, it can cause a
failure. When tcp_recvmsg_dmabuf() iterates over the fragments and encounters
the io_uring fragment, it will trigger the following check:

net/ipv4/tcp.c:tcp_recvmsg_dmabuf() {
    ...
            niov = skb_frag_net_iov(frag);
            if (!net_is_devmem_iov(niov)) {
                err = -ENODEV;
                goto out;
            }
    ...
}

This breaks the receive path and drops the payload. 

Additionally, if memory providers supply CPU-readable netmems (as
architecturally allowed by this commit), the check evaluates to true != true,
which fails to prevent mixing system pages with memory-provider fragments.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010033630.1171692-1-almasrymina@google.com?part=1