Re: [PATCH net v2 3/3] net: tcp: block standard payload injection into devmem skbs

[Bobby Eshleman <bobbyeshleman@gmail.com>]

On Mon, Aug 03, 2026 at 05:14:41PM +0000, Mina Almasry wrote:
> Protect tcp_sendmsg_locked() from mistakenly appending non-zerocopy
> page fragments to unreadable devmem skbs. Create a new segment instead.
> 
> Fixes: bd61848900bff ("net: devmem: Implement TX path")
> Cc: Pavel Begunkov <asml.silence@gmail.com>
> Cc: Stanislav Fomichev <sdf@fomichev.me>
> Cc: Bobby Eshleman <bobbyeshleman@gmail.com>
> Signed-off-by: Mina Almasry <almasrymina@google.com>
> Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>
> ---
>  net/ipv4/tcp.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 455441f1b6949..186a36c698798 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1278,6 +1278,11 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>  		if (copy > msg_data_left(msg))
>  			copy = msg_data_left(msg);
>  
> +		if (zc != MSG_ZEROCOPY && unlikely(!skb_frags_readable(skb))) {
> +			tcp_mark_push(tp, skb);
> +			goto new_segment;
> +		}
> +
>  		if (zc == 0) {
>  			bool merge = true;
>  			int i = skb_shinfo(skb)->nr_frags;
> -- 
> 2.55.0.571.g244d577d93-goog
> 

Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>