From 89b9db72918bc209029fad8cccc42191b498d511 Mon Sep 17 00:00:00 2001 From: Kaifeng Wang Date: Mon, 19 Oct 2026 17:45:22 +0000 Subject: [PATCH] tcp: reject devmem tx with fastopen and repair tcp_sendmsg_locked() enforces that devmem TX can only proceed if the zero-copy path is active and a valid dmabuf binding exists. However, subsequent branches in tcp_sendmsg_locked() can still intercept the message before it reaches the devmem zero-copy loop: 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT): If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use copy_page_from_iter() to byte-copy from the iterator. Since iov_base represents dma-buf offsets rather than user virtual addresses, this misinterprets offsets as user pointers and copies the caller's memory at those addresses into the SYN packet. 2. TCP repair mode: If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly calls skb_copy_datagram_from_iter(), byte-copying from the iterator. Neither path supports or makes sense for devmem transmission. Reject devmem sends inside the Fast Open and TCP repair branches when a devmem binding is present. Checking inside the tp->repair branch also covers the case where repair mode is enabled while sk_stream_wait_connect() drops the socket lock. Additionally, drop the !sockc_err gate from the devmem validation check and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is followed by a failing cmsg, sockc.dmabuf_id remains set while binding is not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to proceed and return before sockc_err is checked. This pre-existing issue was identified by Sashiko AI review on commit 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been hit in production. Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx") Fixes: bd61848900bf ("net: devmem: Implement TX path") Reviewed-by: Mina Almasry Signed-off-by: Kaifeng Wang Acked-by: Stanislav Fomichev Reviewed-by: Eric Dumazet Reviewed-by: Pavel Begunkov Link: https://patch.msgid.link/20261019174522.55644-1-kaifengw@google.com Signed-off-by: Jakub Kicinski --- net/ipv4/tcp.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 99d7237a623d..76df69aa0115 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1172,14 +1172,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) zc = MSG_SPLICE_PAGES; } - if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) { - err = -EINVAL; + if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) { + err = sockc_err ?: -EINVAL; goto out_err; } if (unlikely(flags & MSG_FASTOPEN || inet_test_bit(DEFER_CONNECT, sk)) && !tp->repair) { + if (binding) { + err = -EINVAL; + goto out_err; + } err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size, uarg); if (err == -EINPROGRESS && copied_syn > 0) goto out; @@ -1203,6 +1207,10 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) } if (unlikely(tp->repair)) { + if (binding) { + err = -EINVAL; + goto out_err; + } if (tp->repair_queue == TCP_RECV_QUEUE) { copied = tcp_send_rcvq(sk, msg, size); goto out_nopush;