[PATCH net-next v5 0/3] net: prevent mixing incompatible memory providers in skbs

[Mina Almasry <almasrymina@google.com>]

Enforce that all fragments in a nonlinear skb come from compatible
memory providers (and for devmem, the exact same binding).

Patch 1 fixes skb->unreadable propagation in skb_split() and skb_shift().
Patch 2 adds skb_net_iov_provider(), skb_mem_provider_compat(), and
skb_frags_can_coalesce(), and enforces provider/binding compatibility
across TX, TCP, GRO, skb_shift(), and skb_try_coalesce().
Patch 3 propagates the skb_zcopy() uarg to the probe skb in
tcp_mtu_probe() / tcp_clone_payload() and rejects coalescing across
different uargs.

v4 -> v5:
- Drop skb_has_net_iovs() and check skb_frags_readable() and
  skb_shinfo(skb)->nr_frags directly in skb_net_iov_provider() and
  net_devmem_skb_binding().
- Add patch 3 to propagate the skb_zcopy() uarg in tcp_mtu_probe() /
  tcp_clone_payload().
- v4: https://lore.kernel.org/netdev/20261108013838.1454450-1-almasrymina@google.com/

v3 -> v4:
- Fold skb_shinfo(skb)->nr_frags into skb_has_net_iovs() and drop
  redundant nr_frags checks in skb_net_iov_provider() and
  net_devmem_skb_binding() (Stanislav Fomichev).
- Remove the empty-skb check and redundant !skb_has_net_iovs(skb1)
  branch from skb_mem_provider_compat(), and add a comment on the
  early skb_has_net_iovs() check (Stanislav Fomichev).
- Propagate skb->unreadable and compare skb_frag_netmem() directly in
  tcp_clone_payload() instead of rejecting unreadable skbs in
  tcp_can_coalesce_send_queue_head().
- v3: https://lore.kernel.org/netdev/20261104042521.3979880-1-almasrymina@google.com/

v2 -> v3:
- Drop patch 2 ('netmem: store memory provider private pointer directly
  in struct net_iov') and compare net_iov_owner(niov) (for devmem) /
  niov->desc.pp (for other net_iov providers) directly in
  skb_mem_provider_compat() (Stanislav Fomichev).
- Squash the skb_frags_can_coalesce() helper patch into its caller patch
  (Stanislav Fomichev).
- v2: https://lore.kernel.org/netdev/20261102231827.4088254-1-almasrymina@google.com/

v1 -> v2:
- Generalize the check across TX, TCP collapse, GRO, IP defrag,
  skb_shift(), and skb_try_coalesce() by storing mp_priv directly in
  struct net_iov and introducing skb_frags_can_coalesce().
- Fix skb->unreadable propagation in skb_split() and skb_shift().
- Add KUnit coverage for cross-provider and cross-binding rejection.
- v1: https://lore.kernel.org/netdev/20261008034027.1403188-1-almasrymina@google.com/

Mina Almasry (3):
  net: fix skb->unreadable propagation in skb_split() and skb_shift()
  net: prevent mixing frags from different memory providers or bindings
  tcp: propagate skb_zcopy() uarg in tcp_mtu_probe()

 include/linux/skbuff.h | 55 ++++++++++++++++++++++++++++++++++++++++++
 include/net/tcp.h      |  5 ++--
 net/core/datagram.c    |  4 +--
 net/core/dev.c         | 14 ++++-------
 net/core/devmem.h      | 22 +++++++++++++++++
 net/core/gro.c         | 16 ++++--------
 net/core/net_test.c    | 42 +++++++++++++++++++++++++++-----
 net/core/skbuff.c      | 32 ++++++++++++------------
 net/ipv4/tcp.c         |  3 ++-
 net/ipv4/tcp_output.c  |  9 +++++--
 10 files changed, 153 insertions(+), 49 deletions(-)


base-commit: 6964ff21c5d8b75649211a52dbfd92753e605649
-- 
2.56.0.611.g1030f0b940-goog