When skb_zerocopy() copies devmem payload fragments, it fails to update the target skb's unreadable flag. This causes the target to appear as readable memory. Propagate the unreadable flag if any devmem fragments were copied from the source. Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Cc: Pavel Begunkov Cc: Stanislav Fomichev Cc: Bobby Eshleman Cc: Florian Westphal Signed-off-by: Mina Almasry --- net/core/skbuff.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index ba3dbac80fb49..aebe8ea74776a 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3928,6 +3928,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) } skb_shinfo(to)->nr_frags = j; + if (i > 0 && from->unreadable) + to->unreadable = 1; + return 0; } EXPORT_SYMBOL_GPL(skb_zerocopy); -- 2.55.0.571.g244d577d93-goog When a devmem payload mixes with a standard page payload, return -EMSGSIZE instead of -EFAULT. This enables tcp_sendmsg to seamlessly fall back to creating a new segment instead of failing the socket send. Fixes: bd61848900bff ("net: devmem: Implement TX path") Cc: Pavel Begunkov Cc: Stanislav Fomichev Cc: Bobby Eshleman Signed-off-by: Mina Almasry --- net/core/datagram.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/core/datagram.c b/net/core/datagram.c index 173b5d97bd409..6f8ffd61bcab4 100644 --- a/net/core/datagram.c +++ b/net/core/datagram.c @@ -638,7 +638,7 @@ int zerocopy_fill_skb_from_iter(struct sk_buff *skb, int frag = skb_shinfo(skb)->nr_frags; if (!skb_frags_readable(skb)) - return -EFAULT; + return -EMSGSIZE; while (length && iov_iter_count(from)) { struct page *head, *last_head = NULL; @@ -713,7 +713,7 @@ zerocopy_fill_skb_from_devmem(struct sk_buff *skb, struct iov_iter *from, struct net_iov *niov; if (i && skb_frags_readable(skb)) - return -EFAULT; + return -EMSGSIZE; /* Devmem filling works by taking an IOVEC from the user where the * iov_addrs are interpreted as an offset in bytes into the dma-buf to -- 2.55.0.571.g244d577d93-goog Protect tcp_sendmsg_locked() from mistakenly appending non-zerocopy page fragments to unreadable devmem skbs. Create a new segment instead. Fixes: bd61848900bff ("net: devmem: Implement TX path") Cc: Pavel Begunkov Cc: Stanislav Fomichev Cc: Bobby Eshleman Signed-off-by: Mina Almasry --- net/ipv4/tcp.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 455441f1b6949..186a36c698798 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1278,6 +1278,11 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) if (copy > msg_data_left(msg)) copy = msg_data_left(msg); + if (zc != MSG_ZEROCOPY && unlikely(!skb_frags_readable(skb))) { + tcp_mark_push(tp, skb); + goto new_segment; + } + if (zc == 0) { bool merge = true; int i = skb_shinfo(skb)->nr_frags; -- 2.55.0.571.g244d577d93-goog