[PATCH net v2 1/3] net: core: propagate unreadable flag in skb_zerocopy

[PATCH net v2 1/3] net: core: propagate unreadable flag in skb_zerocopy

[Mina Almasry]

When skb_zerocopy() copies devmem payload fragments, it fails to update
the target skb's unreadable flag. This causes the target to appear as
readable memory.

Propagate the unreadable flag if any devmem fragments were copied from
the source.

Additionally, to prevent memory corruption, explicitly return -EFAULT
if standard payload from the head is mixed into the same skb alongside
unreadable devmem fragments during a head-to-frag extraction.

Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>

---
v2:
- Return -EFAULT when mixing head-to-frag unreadable/readable frags to prevent memory corruption (Pavel).
v1: https://lore.kernel.org/r/20260801125308.1342897-1-almasrymina@google.com
---
 net/core/skbuff.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index ba3dbac80fb49..8bacc6c4e16e1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3905,6 +3905,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 		}
 	}
 
+	if (!skb_frags_readable(from) && j > 0 && len)
+		return -EFAULT;
+
 	skb_len_add(to, len + plen);
 
 	if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
@@ -3928,6 +3931,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 	}
 	skb_shinfo(to)->nr_frags = j;
 
+	if (i > 0 && from->unreadable)
+		to->unreadable = 1;
+
 	return 0;
 }
 EXPORT_SYMBOL_GPL(skb_zerocopy);

base-commit: af39eb111ce6b5eba9c08513b62c4868eb7e7fd5
-- 
2.55.0.571.g244d577d93-goog

[PATCH net v2 2/3] net: devmem: return EMSGSIZE on type mismatch

[Mina Almasry]

When a devmem payload mixes with a standard page payload, return
-EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly
fall back to creating a new segment instead of failing the socket send.

Fixes: bd61848900bff ("net: devmem: Implement TX path")
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
Signed-off-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
---
 net/core/datagram.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 173b5d97bd409..6f8ffd61bcab4 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -638,7 +638,7 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb,
 	int frag = skb_shinfo(skb)->nr_frags;
 
 	if (!skb_frags_readable(skb))
-		return -EFAULT;
+		return -EMSGSIZE;
 
 	while (length && iov_iter_count(from)) {
 		struct page *head, *last_head = NULL;
@@ -713,7 +713,7 @@ zerocopy_fill_skb_from_devmem(struct sk_buff *skb, struct iov_iter *from,
 	struct net_iov *niov;
 
 	if (i && skb_frags_readable(skb))
-		return -EFAULT;
+		return -EMSGSIZE;
 
 	/* Devmem filling works by taking an IOVEC from the user where the
 	 * iov_addrs are interpreted as an offset in bytes into the dma-buf to
-- 
2.55.0.571.g244d577d93-goog

Re: [PATCH net v2 2/3] net: devmem: return EMSGSIZE on type mismatch

[Bobby Eshleman]

On Mon, Aug 03, 2026 at 05:14:40PM +0000, Mina Almasry wrote:
> When a devmem payload mixes with a standard page payload, return
> -EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly
> fall back to creating a new segment instead of failing the socket send.
> 
> Fixes: bd61848900bff ("net: devmem: Implement TX path")
> Cc: Pavel Begunkov <asml.silence@gmail.com>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
> Signed-off-by: Mina Almasry <almasrymina@google.com>
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  net/core/datagram.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/net/core/datagram.c b/net/core/datagram.c
> index 173b5d97bd409..6f8ffd61bcab4 100644
> --- a/net/core/datagram.c
> +++ b/net/core/datagram.c
> @@ -638,7 +638,7 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb,
>  	int frag = skb_shinfo(skb)->nr_frags;
>  
>  	if (!skb_frags_readable(skb))
> -		return -EFAULT;
> +		return -EMSGSIZE;
>  
>  	while (length && iov_iter_count(from)) {
>  		struct page *head, *last_head = NULL;
> @@ -713,7 +713,7 @@ zerocopy_fill_skb_from_devmem(struct sk_buff *skb, struct iov_iter *from,
>  	struct net_iov *niov;
>  
>  	if (i && skb_frags_readable(skb))
> -		return -EFAULT;
> +		return -EMSGSIZE;
>  
>  	/* Devmem filling works by taking an IOVEC from the user where the
>  	 * iov_addrs are interpreted as an offset in bytes into the dma-buf to
> -- 
> 2.55.0.571.g244d577d93-goog
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>

Re: [PATCH net v2 2/3] net: devmem: return EMSGSIZE on type mismatch

[Jakub Kicinski]

On Mon,  3 Aug 2026 17:14:40 +0000 Mina Almasry wrote:
> When a devmem payload mixes with a standard page payload, return
> -EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly
> fall back to creating a new segment instead of failing the socket send.

Sure but AFAIU this was discovered during a ML discussion,
so the change is an improvement for net-next rather than a fix.
Do you have any reason to believe that real applications hit
the error?

Also please add cover letters for submissions with more than 2 patches.

Re: [PATCH net v2 2/3] net: devmem: return EMSGSIZE on type mismatch

[Mina Almasry]

On Mon, Aug 3, 2026 at 12:54 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Mon,  3 Aug 2026 17:14:40 +0000 Mina Almasry wrote:
> > When a devmem payload mixes with a standard page payload, return
> > -EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly
> > fall back to creating a new segment instead of failing the socket send.
>
> Sure but AFAIU this was discovered during a ML discussion,
> so the change is an improvement for net-next rather than a fix.
> Do you have any reason to believe that real applications hit
> the error?
>

No, I don't have a reason; I just thought it was a straightforward fix
you might want to take in net. I can definitely punt this to net-next.
I'm a bit unsure whether you want this series reposted as v3 without
this patch, or if you're going to take the other 2 patches. I guess if
I don't see the rest merged I'll repost. Thanks!

> Also please add cover letters for submissions with more than 2 patches.

Will do, thanks! I'm slightly unsure about a commit message that
basically says "Here a bunch of fixes to devmem reported by sashiko.",
but I'll give that a shot.

-- 
Thanks,
Mina

Re: [PATCH net v2 2/3] net: devmem: return EMSGSIZE on type mismatch

[Jakub Kicinski]

On Tue, 4 Aug 2026 08:36:40 -0700 Mina Almasry wrote:
> On Mon, Aug 3, 2026 at 12:54 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Mon,  3 Aug 2026 17:14:40 +0000 Mina Almasry wrote:  
> > > When a devmem payload mixes with a standard page payload, return
> > > -EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly
> > > fall back to creating a new segment instead of failing the socket send.  
> >
> > Sure but AFAIU this was discovered during a ML discussion,
> > so the change is an improvement for net-next rather than a fix.
> > Do you have any reason to believe that real applications hit
> > the error?
> 
> No, I don't have a reason; I just thought it was a straightforward fix
> you might want to take in net. I can definitely punt this to net-next.
> I'm a bit unsure whether you want this series reposted as v3 without
> this patch, or if you're going to take the other 2 patches. I guess if
> I don't see the rest merged I'll repost. Thanks!

split and repost please

[PATCH net v2 3/3] net: tcp: block standard payload injection into devmem skbs

[Mina Almasry]

Protect tcp_sendmsg_locked() from mistakenly appending non-zerocopy
page fragments to unreadable devmem skbs. Create a new segment instead.

Fixes: bd61848900bff ("net: devmem: Implement TX path")
Cc: Pavel Begunkov <asml.silence@gmail.com>
Cc: Stanislav Fomichev <sdf@fomichev.me>
Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
Signed-off-by: Mina Almasry <almasrymina@google.com>
Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
---
 net/ipv4/tcp.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 455441f1b6949..186a36c698798 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1278,6 +1278,11 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 		if (copy > msg_data_left(msg))
 			copy = msg_data_left(msg);
 
+		if (zc != MSG_ZEROCOPY && unlikely(!skb_frags_readable(skb))) {
+			tcp_mark_push(tp, skb);
+			goto new_segment;
+		}
+
 		if (zc == 0) {
 			bool merge = true;
 			int i = skb_shinfo(skb)->nr_frags;
-- 
2.55.0.571.g244d577d93-goog

Re: [PATCH net v2 3/3] net: tcp: block standard payload injection into devmem skbs

[Bobby Eshleman]

On Mon, Aug 03, 2026 at 05:14:41PM +0000, Mina Almasry wrote:
> Protect tcp_sendmsg_locked() from mistakenly appending non-zerocopy
> page fragments to unreadable devmem skbs. Create a new segment instead.
> 
> Fixes: bd61848900bff ("net: devmem: Implement TX path")
> Cc: Pavel Begunkov <asml.silence@gmail.com>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
> Signed-off-by: Mina Almasry <almasrymina@google.com>
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  net/ipv4/tcp.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 455441f1b6949..186a36c698798 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1278,6 +1278,11 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>  		if (copy > msg_data_left(msg))
>  			copy = msg_data_left(msg);
>  
> +		if (zc != MSG_ZEROCOPY && unlikely(!skb_frags_readable(skb))) {
> +			tcp_mark_push(tp, skb);
> +			goto new_segment;
> +		}
> +
>  		if (zc == 0) {
>  			bool merge = true;
>  			int i = skb_shinfo(skb)->nr_frags;
> -- 
> 2.55.0.571.g244d577d93-goog
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>

Re: [PATCH net v2 1/3] net: core: propagate unreadable flag in skb_zerocopy

[Bobby Eshleman]

On Mon, Aug 03, 2026 at 05:14:39PM +0000, Mina Almasry wrote:
> When skb_zerocopy() copies devmem payload fragments, it fails to update
> the target skb's unreadable flag. This causes the target to appear as
> readable memory.
> 
> Propagate the unreadable flag if any devmem fragments were copied from
> the source.
> 
> Additionally, to prevent memory corruption, explicitly return -EFAULT
> if standard payload from the head is mixed into the same skb alongside
> unreadable devmem fragments during a head-to-frag extraction.
> 
> Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags")
> Cc: Pavel Begunkov <asml.silence@gmail.com>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
> Cc: Florian Westphal <fw@strlen.de>
> Signed-off-by: Mina Almasry <almasrymina@google.com>
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
> 
> ---
> v2:
> - Return -EFAULT when mixing head-to-frag unreadable/readable frags to prevent memory corruption (Pavel).
> v1: https://lore.kernel.org/r/20260801125308.1342897-1-almasrymina@google.com
> ---
>  net/core/skbuff.c | 6 ++++++
>  1 file changed, 6 insertions(+)
> 
> diff --git a/net/core/skbuff.c b/net/core/skbuff.c
> index ba3dbac80fb49..8bacc6c4e16e1 100644
> --- a/net/core/skbuff.c
> +++ b/net/core/skbuff.c
> @@ -3905,6 +3905,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
>  		}
>  	}
>  
> +	if (!skb_frags_readable(from) && j > 0 && len)
> +		return -EFAULT;
> +
>  	skb_len_add(to, len + plen);
>  
>  	if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
> @@ -3928,6 +3931,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
>  	}
>  	skb_shinfo(to)->nr_frags = j;
>  
> +	if (i > 0 && from->unreadable)
> +		to->unreadable = 1;
> +
>  	return 0;
>  }
>  EXPORT_SYMBOL_GPL(skb_zerocopy);
> 
> base-commit: af39eb111ce6b5eba9c08513b62c4868eb7e7fd5
> -- 
> 2.55.0.571.g244d577d93-goog
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>