[PATCH net-next v5 3/3] tcp: propagate skb_zcopy() uarg in tcp_mtu_probe()

[Mina Almasry <almasrymina@google.com>]

tcp_clone_payload() takes references on source skb fragments when
building an MTU probe skb, but never attaches the source skb's zerocopy
ubuf_info (uarg) to the probe skb. When tcp_mtu_probe() subsequently
frees fully consumed source skbs via tcp_eat_one_skb(), skb_release_data()
drops their uarg references and can deliver the zerocopy completion to
userspace while the unacknowledged probe skb still references the user
buffers.

Additionally, tcp_can_coalesce_send_queue_head() only checks
skb_pure_zcopy_same() (which compares SKBFL_PURE_ZEROCOPY), allowing
adjacent zerocopy skbs with different uargs (or a mixed-zerocopy skb and
a non-zerocopy skb) to be coalesced into a single probe skb that can
only hold one destructor_arg.

Reject coalescing across different skb_zcopy() uargs in
tcp_can_coalesce_send_queue_head() and propagate the uarg to the probe
skb via skb_zcopy_set() in tcp_clone_payload().

This is a pre-existing issue found by manual code inspection and LLM
review; it was not triggered in production. Verified with the net_core
KUnit test suite; not tested on real hardware.

Fixes: 736013292e3c ("tcp: let tcp_mtu_probe() build headless packets")
Signed-off-by: Mina Almasry <almasrymina@google.com>
---
 net/ipv4/tcp_output.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 19059d03152e..bedf828cc0e0 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2664,7 +2664,9 @@ static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len)
 		if (len <= skb->len)
 			break;
 
-		if (tcp_has_tx_tstamp(skb) || !tcp_skb_can_collapse(skb, next))
+		if (tcp_has_tx_tstamp(skb) ||
+		    !tcp_skb_can_collapse(skb, next) ||
+		    skb_zcopy(skb) != skb_zcopy(next))
 			return false;
 
 		len -= skb->len;
@@ -2718,6 +2720,7 @@ static int tcp_clone_payload(struct sock *sk, struct sk_buff *to,
 	WARN_ON_ONCE(len != probe_size);
 	for (i = 0; i < nr_frags; i++)
 		skb_frag_ref(to, i);
+	skb_zcopy_set(to, skb_zcopy(tcp_send_head(sk)), NULL);
 
 	skb_shinfo(to)->nr_frags = nr_frags;
 	to->truesize += probe_size;
-- 
2.56.0.611.g1030f0b940-goog