Re: [PATCH net 1/1] net: devmem: prevent net-iov / page mixing

[Pavel Begunkov <asml.silence@gmail.com>]

On 7/24/26 20:07, Bobby Eshleman wrote:
> On Wed, Jul 22, 2026 at 07:58:27PM +0100, Pavel Begunkov wrote:
>> On 7/22/26 18:59, Bobby Eshleman wrote:
>>> On Wed, Jul 22, 2026 at 11:58:46AM +0100, Pavel Begunkov wrote:
>>>> We should either have net_iov or page backed frags in a single skb,
>>>> otherwise it blows up down the stack. Don't allow mixing in
>>>> zerocopy_fill_skb_from_devmem().
>>>>
>>>> Fixes: bd61848900bff ("net: devmem: Implement TX path")
>>>> Cc: stable@vger.kernel.org
>>>> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
>>>> ---
>>>>    net/core/datagram.c | 3 +++
>>>>    1 file changed, 3 insertions(+)
>>>>
>>>> diff --git a/net/core/datagram.c b/net/core/datagram.c
>>>> index c285c6465923..35febc1c25fa 100644
>>>> --- a/net/core/datagram.c
>>>> +++ b/net/core/datagram.c
>>>> @@ -712,6 +712,9 @@ zerocopy_fill_skb_from_devmem(struct sk_buff *skb, struct iov_iter *from,
>>>>    	size_t virt_addr, size, off;
>>>>    	struct net_iov *niov;
>>>> +	if (i && skb_frags_readable(skb))
>>>> +		return -EEXIST;
>>>
>>> Are we trying to hit the -EEXIST handler in tcp_sendmsg_locked() so that
>>> we start a new skb? If so, I think we might need to plumb this -EEXIST
>>> case through skb_zerocopy_iter_stream() too?
>>
>> Easier to EFAULT. It'd more consistent, and I don't care how tcp takes
>> it specifically.
>>
>> -- 
>> Pavel Begunkov
>>
> 
> One socket is allowed to queue non-devmem followed by devmem, and EFAULT
> will break this case. I think EEXIST is right, just needs to propagate
> up.
Regardless of whether it's a good thing or not, mixing is already
rejected, see zerocopy_fill_skb_from_iter(). Not 100% consistent
though for the user as it's timing dependent.

-- 
Pavel Begunkov