From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 437B24A3410 for ; Fri, 14 Aug 2026 19:13:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.199 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786734821; cv=none; b=LZGdxAJaaIFhSwI2d2LJeZP4y0OtpBeCh4by9VGFg2nwJKpLA/h8B21hIhpmc3xhofSG/z7rtfBBYXOZ4cyS8KXw9JUFhPbLKl1pqrlsEm1Ix2CDWR/SZFH3V5BL/Fkx7PE9GHMsmsMCxrX13k0JubkQeoJu0zx7w21IAr7DWX4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786734821; c=relaxed/simple; bh=8psm+vfJeN5Sa6df/bJ4T2K8atloHaVdU6/1VgSOj/g=; h=Date:Mime-Version:Message-ID:Subject:From:To:Cc:Content-Type; b=WcGKDVt6Dc2YlqPzFiCRrIvaAS9oF58NcvnOl4VVFmcAZAyVlfRueiMG5iZItjrG6B8kmcLDs8cysnlkhpdN+d8J2hWgQ6RSTTsv9mxrF/X9E5X05SgvblBFArouuFGgQDMrcsNPCHg5GXdmk/A4/eZtyALEAbhBKyG0e209xGg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=sz2p3A5Y; arc=none smtp.client-ip=209.85.214.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--almasrymina.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="sz2p3A5Y" Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cc7e86e7c5so23496285ad.3 for ; Fri, 14 Aug 2026 12:13:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786734818; x=1787339618; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:mime-version:date:from :to:cc:subject:date:message-id:reply-to:content-type; bh=OI+1skUob0SWIdAwytp9RXQE8P/u0Lcv+pNJU3Jw3Ls=; b=sz2p3A5YsN0S9OKC3WgyTID26+HvKGlPmNqJ0NUVrKPK6xvfe8JYm+jYI11LIemxhf Dk/D4kG+sydNZyashPGc1vwAonblWnQhdKzIjQ7LjbZktE6Ryzc6ZkVnxMCSW3juU068 njAPx0kHUQQiVvW44w0CS45NUS3y2XAg7ddkvMdn/hZgkzknhvReSY346jW/umyhHJ04 KJCxr3GTwc83XhNdLssIVQyXWgUuzfUpMNXfkRmakBjgzs67uCFOkSpTwIGhfCTCWmmu 8EfF/yHcB2KrcTyDXZq1RDObyzE/pHg5KrYijJ1Zy1ruhsJPV/83TamNturLgvJC0hCl H1sQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786734818; x=1787339618; h=content-type:cc:to:from:subject:message-id:mime-version:date :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=OI+1skUob0SWIdAwytp9RXQE8P/u0Lcv+pNJU3Jw3Ls=; b=c8/NJEDLyEqFSmVqypdoTwBxhfJ0E1PgXCCOsiViMoEmXD8pVIGnakdD18hu1bSuEh oriHKbjTE8zt809h8ugk9d677LxMl5HLJCURGPDVVZB/VlRkA0sOTt7py+MS+wjUhqJM mIyAPeWRs9mfgAkoTMq80zfieWuBdBxWpxNBE2eeFvlH5J4dWQvFviYvLhFwv01/XOuB DzCQCy6Mzmod6CbO3hB3VrGEr0zPKBaJd7mIiWn3EvbvnMGJsIAjZLynG7N3qVr1HAAe rfqbjD+vHwfIE6pZVGHOGWBG93sXgiL99mYntJTo+mqqdiRVveFhtAbZSC1MWfXkgOqq jYbA== X-Forwarded-Encrypted: i=1; AHgh+Rr4oFzvHCMXMqNjn4BnbBsWahWqcec6L4IFvW1krYGvqpWHagQ3bSXhztnsYp7JXgXdgWZsOh3M/FVhfRI=@vger.kernel.org X-Gm-Message-State: AOJu0YzG7NDSp/BdSugF054roWa7PKNm39l7PNUp9cM5NFNvYOWv/TYY CqTLuIYy9oYBg2D0ZJpxy3aIU4MsgOZzLa2+NKZ5eD8pQRe0IMHmvaRtyBDZiZ2kjuJy/IqVdqi 1kwsCCuHtycXOhOL4u7y+h8Iamw== X-Received: from dybvt10.prod.google.com ([2002:a05:7301:78ca:b0:313:d014:d248]) (user=almasrymina job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:2443:b0:3c3:9070:96bf with SMTP id adf61e73a8af0-3cc71b60f1emr8183683637.9.1786734817521; Fri, 14 Aug 2026 12:13:37 -0700 (PDT) Date: Fri, 14 Aug 2026 19:13:30 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260814191336.187243-1-almasrymina@google.com> Subject: [PATCH net v4 1/2] net: core: propagate unreadable flag in skb_zerocopy From: Mina Almasry To: Jakub Kicinski , Kaiyuan Zhang , Willem de Bruijn , Eric Dumazet , Mina Almasry , Paolo Abeni , Stanislav Fomichev , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, dev@openvswitch.org Cc: "David S. Miller" , Simon Horman , Neal Cardwell , Kuniyuki Iwashima , Aaron Conole , Eelco Chaudron , Ilya Maximets , Jason Xing , Pavel Begunkov , Bobby Eshleman , Florian Westphal Content-Type: text/plain; charset="UTF-8" skb_zerocopy() fails to propagate the unreadable flag when copying unreadable fragments, causing target skbs to appear as readable memory. This patch fixes the flag propagation. Additionally, it returns -EFAULT if readable fragments are mixed with unreadable fragments during extraction, and returns -EFAULT in openvswitch queue_userspace_packet(). Fixes: 65249feb6b3d ("net: add support for skbs with unreadable frags") Cc: Pavel Begunkov Cc: Stanislav Fomichev Cc: Bobby Eshleman Cc: Florian Westphal Cc: Aaron Conole Cc: Eelco Chaudron Cc: Ilya Maximets Cc: Willem de Bruijn Signed-off-by: Mina Almasry Reviewed-by: Pavel Begunkov Reviewed-by: Ilya Maximets --- v4: - Changed commit references from payload types to readable/unreadable fragments. --- net/core/skbuff.c | 13 ++++++++++++- net/openvswitch/datapath.c | 3 +++ 2 files changed, 15 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index ba3dbac80fb49..d21af68156950 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3870,7 +3870,8 @@ EXPORT_SYMBOL_GPL(skb_zerocopy_headlen); * Return value: * 0: everything is OK * -ENOMEM: couldn't orphan frags of @from due to lack of memory - * -EFAULT: skb_copy_bits() found some problem with skb geometry + * -EFAULT: skb_copy_bits() found some problem with skb geometry, or readable head + * payload would be mixed with unreadable frags. */ int skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) @@ -3905,10 +3906,17 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) } } + if (!skb_frags_readable(from) && j > 0 && len) { + put_page(virt_to_head_page(from->head)); + return -EFAULT; + } + skb_len_add(to, len + plen); if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) { skb_tx_error(from); + if (j > 0) + put_page(virt_to_head_page(from->head)); return -ENOMEM; } skb_zerocopy_clone(to, from, GFP_ATOMIC); @@ -3928,6 +3936,9 @@ skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen) } skb_shinfo(to)->nr_frags = j; + if (i > 0 && from->unreadable) + to->unreadable = 1; + return 0; } EXPORT_SYMBOL_GPL(skb_zerocopy); diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c index ae69b2cabab9e..482893a5f67dc 100644 --- a/net/openvswitch/datapath.c +++ b/net/openvswitch/datapath.c @@ -467,6 +467,9 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb, if (!dp_ifindex) return -ENODEV; + if (!skb_frags_readable(skb)) + return -EFAULT; + if (skb_vlan_tag_present(skb)) { nskb = skb_clone(skb, GFP_ATOMIC); if (!nskb) base-commit: 24ef02f934eeb48830cff6b739abc3c62b1d107b -- 2.55.0.691.gc56d675ccc-goog