Re: [PATCH net v2] net: devmem: prevent net-iov / page mixing

[Pavel Begunkov <asml.silence@gmail.com>]

On 7/27/26 17:07, Bobby Eshleman wrote:
> On Mon, Jul 27, 2026 at 12:19:37PM +0100, Pavel Begunkov wrote:
>> We should either have net_iov or page backed frags in a single skb,
>> otherwise it blows up down the stack. Don't allow mixing in
>> zerocopy_fill_skb_from_devmem().
>>
>> Fixes: bd61848900bff ("net: devmem: Implement TX path")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
>> ---
>>
>> v2: EEXIST -> EFAULT, as skb_zerocopy_iter_stream() doesn't handle
>>      the former + for consistency.
>>
>>   net/core/datagram.c | 3 +++
>>   1 file changed, 3 insertions(+)
>>
>> diff --git a/net/core/datagram.c b/net/core/datagram.c
>> index c285c6465923..173b5d97bd40 100644
>> --- a/net/core/datagram.c
>> +++ b/net/core/datagram.c
>> @@ -712,6 +712,9 @@ zerocopy_fill_skb_from_devmem(struct sk_buff *skb, struct iov_iter *from,
>>   	size_t virt_addr, size, off;
>>   	struct net_iov *niov;
>>   
>> +	if (i && skb_frags_readable(skb))
>> +		return -EFAULT;
>> +
> 
> Doesn't this still break the allowed scenario where the user does
> sendmsg(not devmem) before sendmsg(devmem), and tcp tries to append to
> the write tail skb?
Considering that it crashes the kernel, no, it doesn't.

-- 
Pavel Begunkov