Protect tcp_sendmsg_locked() from mistakenly mixing readable and unreadable page fragments in the same SKB. Check that the devmem binding matches the existing SKB's readability. If a mismatch is detected, avoid collapsing and create a new segment. Fixes: bd61848900bff ("net: devmem: Implement TX path") Suggested-by: Eric Dumazet Cc: Pavel Begunkov Cc: Stanislav Fomichev Cc: Bobby Eshleman Signed-off-by: Mina Almasry --- v4: - Adopt Eric's suggestion to check 'binding' against SKB readability alongside tcp_skb_can_collapse_to(). - Drop pre-existing Reviewed-by tags due to significant implementation changes. v3: https://lore.kernel.org/r/20260811195405.3979177-2-almasrymina@google.com v2: https://lore.kernel.org/r/20260810180956.2348280-2-almasrymina@google.com v1: https://lore.kernel.org/r/20260801125308.1342897-3-almasrymina@google.com --- net/ipv4/tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 455441f1b6949..b4237d0e994d6 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1240,7 +1240,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) trace_tcp_sendmsg_locked(sk, msg, skb, size_goal); - if (copy <= 0 || !tcp_skb_can_collapse_to(skb)) { + if (copy <= 0 || !tcp_skb_can_collapse_to(skb) || + unlikely(skb_frags_readable(skb) != !binding)) { bool first_skb; new_segment: -- 2.55.0.691.gc56d675ccc-goog