[PATCH net v2] tcp: reject devmem tx with fastopen and repair

[PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Kaifeng Wang]

tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
zero-copy path is active and a valid dmabuf binding exists. However,
subsequent branches in tcp_sendmsg_locked() can still intercept the
message before it reaches the devmem zero-copy loop:

1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
   If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
   NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
   tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
   copy_page_from_iter() to byte-copy from the iterator. Since iov_base
   represents dma-buf offsets rather than user virtual addresses, this
   misinterprets offsets as user pointers and copies the caller's memory
   at those addresses into the SYN packet.

2. TCP repair mode:
   If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
   calls skb_copy_datagram_from_iter(), byte-copying from the iterator.

Neither path supports or makes sense for devmem transmission. Reject
devmem sends inside the Fast Open and TCP repair branches when a devmem
binding is present. Checking inside the tp->repair branch also covers
the case where repair mode is enabled while sk_stream_wait_connect()
drops the socket lock.

Additionally, drop the !sockc_err gate from the devmem validation check
and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
proceed and return before sockc_err is checked.

This pre-existing issue was identified by Sashiko AI review on commit
125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
hit in production.

Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
Fixes: bd61848900bf ("net: devmem: Implement TX path")
Reviewed-by: Mina Almasry <almasrymina@google.com>
Signed-off-by: Kaifeng Wang <kaifengw@google.com>
---
v1 -> v2:
- Move the devmem rejection checks into the Fast Open and TCP repair
  branches directly, also covering the case where tp->repair is enabled
  while sk_stream_wait_connect() drops the socket lock.
- Drop the !sockc_err gate from the devmem validation check and return
  sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
  failing cmsg from bypassing the check.

 net/ipv4/tcp.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 87ef6d5cbfeb..2792923f0748 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1169,14 +1169,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 			zc = MSG_SPLICE_PAGES;
 	}
 
-	if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
-		err = -EINVAL;
+	if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
+		err = sockc_err ?: -EINVAL;
 		goto out_err;
 	}
 
 	if (unlikely(flags & MSG_FASTOPEN ||
 		     inet_test_bit(DEFER_CONNECT, sk)) &&
 	    !tp->repair) {
+		if (binding) {
+			err = -EINVAL;
+			goto out_err;
+		}
 		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size, uarg);
 		if (err == -EINPROGRESS && copied_syn > 0)
 			goto out;
@@ -1200,6 +1204,10 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 	}
 
 	if (unlikely(tp->repair)) {
+		if (binding) {
+			err = -EINVAL;
+			goto out_err;
+		}
 		if (tp->repair_queue == TCP_RECV_QUEUE) {
 			copied = tcp_send_rcvq(sk, msg, size);
 			goto out_nopush;
-- 
2.56.0.385.gd3acb90ef8-goog

Re: [PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Stanislav Fomichev]

On 10/19, Kaifeng Wang wrote:
> tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
> zero-copy path is active and a valid dmabuf binding exists. However,
> subsequent branches in tcp_sendmsg_locked() can still intercept the
> message before it reaches the devmem zero-copy loop:
> 
> 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
>    If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
>    NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
>    tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
>    copy_page_from_iter() to byte-copy from the iterator. Since iov_base
>    represents dma-buf offsets rather than user virtual addresses, this
>    misinterprets offsets as user pointers and copies the caller's memory
>    at those addresses into the SYN packet.
> 
> 2. TCP repair mode:
>    If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
>    calls skb_copy_datagram_from_iter(), byte-copying from the iterator.
> 
> Neither path supports or makes sense for devmem transmission. Reject
> devmem sends inside the Fast Open and TCP repair branches when a devmem
> binding is present. Checking inside the tp->repair branch also covers
> the case where repair mode is enabled while sk_stream_wait_connect()
> drops the socket lock.
> 
> Additionally, drop the !sockc_err gate from the devmem validation check
> and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
> followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
> not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
> proceed and return before sockc_err is checked.
> 
> This pre-existing issue was identified by Sashiko AI review on commit
> 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
> hit in production.
> 
> Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Reviewed-by: Mina Almasry <almasrymina@google.com>
> Signed-off-by: Kaifeng Wang <kaifengw@google.com>
> ---
> v1 -> v2:
> - Move the devmem rejection checks into the Fast Open and TCP repair
>   branches directly, also covering the case where tp->repair is enabled
>   while sk_stream_wait_connect() drops the socket lock.
> - Drop the !sockc_err gate from the devmem validation check and return
>   sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
>   failing cmsg from bypassing the check.

Acked-by: Stanislav Fomichev <sdf@fomichev.me>

Re: [PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Paolo Abeni]

Adding Eric (for real) and Kuniyuki

On 10/19/26 19:45, Kaifeng Wang wrote:
> tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
> zero-copy path is active and a valid dmabuf binding exists. However,
> subsequent branches in tcp_sendmsg_locked() can still intercept the
> message before it reaches the devmem zero-copy loop:
> 
> 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
>     If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
>     NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
>     tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
>     copy_page_from_iter() to byte-copy from the iterator. Since iov_base
>     represents dma-buf offsets rather than user virtual addresses, this
>     misinterprets offsets as user pointers and copies the caller's memory
>     at those addresses into the SYN packet.
> 
> 2. TCP repair mode:
>     If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
>     calls skb_copy_datagram_from_iter(), byte-copying from the iterator.
> 
> Neither path supports or makes sense for devmem transmission. Reject
> devmem sends inside the Fast Open and TCP repair branches when a devmem
> binding is present. Checking inside the tp->repair branch also covers
> the case where repair mode is enabled while sk_stream_wait_connect()
> drops the socket lock.
> 
> Additionally, drop the !sockc_err gate from the devmem validation check
> and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
> followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
> not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
> proceed and return before sockc_err is checked.
> 
> This pre-existing issue was identified by Sashiko AI review on commit
> 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
> hit in production.
> 
> Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Reviewed-by: Mina Almasry <almasrymina@google.com>
> Signed-off-by: Kaifeng Wang <kaifengw@google.com>
> ---
> v1 -> v2:
> - Move the devmem rejection checks into the Fast Open and TCP repair
>    branches directly, also covering the case where tp->repair is enabled
>    while sk_stream_wait_connect() drops the socket lock.
> - Drop the !sockc_err gate from the devmem validation check and return
>    sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
>    failing cmsg from bypassing the check.
> 
>   net/ipv4/tcp.c | 12 ++++++++++--
>   1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 87ef6d5cbfeb..2792923f0748 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1169,14 +1169,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>   			zc = MSG_SPLICE_PAGES;
>   	}
>   
> -	if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> -		err = -EINVAL;
> +	if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> +		err = sockc_err ?: -EINVAL;
>   		goto out_err;
>   	}
>   
>   	if (unlikely(flags & MSG_FASTOPEN ||
>   		     inet_test_bit(DEFER_CONNECT, sk)) &&
>   	    !tp->repair) {
> +		if (binding) {
> +			err = -EINVAL;
> +			goto out_err;
> +		}
>   		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size, uarg);
>   		if (err == -EINPROGRESS && copied_syn > 0)
>   			goto out;
> @@ -1200,6 +1204,10 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>   	}
>   
>   	if (unlikely(tp->repair)) {
> +		if (binding) {
> +			err = -EINVAL;
> +			goto out_err;
> +		}
>   		if (tp->repair_queue == TCP_RECV_QUEUE) {
>   			copied = tcp_send_rcvq(sk, msg, size);
>   			goto out_nopush;

The ever increasing number of conditionals is a bit concerning, but
I don't see how to avoid the new ones.

/P

Re: [PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Eric Dumazet]

Le mer. 21 oct. 2026 à 12:53, Paolo Abeni <pabeni@redhat.com> a écrit :
>
> Adding Eric (for real) and Kuniyuki

Thanks Paolo.

>
> On 10/19/26 19:45, Kaifeng Wang wrote:
> > tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
> > zero-copy path is active and a valid dmabuf binding exists. However,
> > subsequent branches in tcp_sendmsg_locked() can still intercept the
> > message before it reaches the devmem zero-copy loop:
> >
> > 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
> >     If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
> >     NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
> >     tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
> >     copy_page_from_iter() to byte-copy from the iterator. Since iov_base
> >     represents dma-buf offsets rather than user virtual addresses, this
> >     misinterprets offsets as user pointers and copies the caller's memory
> >     at those addresses into the SYN packet.
> >
> > 2. TCP repair mode:
> >     If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
> >     calls skb_copy_datagram_from_iter(), byte-copying from the iterator.
> >
> > Neither path supports or makes sense for devmem transmission. Reject
> > devmem sends inside the Fast Open and TCP repair branches when a devmem
> > binding is present. Checking inside the tp->repair branch also covers
> > the case where repair mode is enabled while sk_stream_wait_connect()
> > drops the socket lock.


Note that the check in the tp->repair branch also rejects
TCP_SEND_QUEUE, not only TCP_RECV_QUEUE. This is fine (a devmem
binding can not be restored by CRIU anyway), but the changelog
could say so.

Also, an application using TCP_FASTOPEN_CONNECT will now get -EINVAL
on its first devmem sendmsg(), and the SYN is not sent. Again fine
for a net fix, just worth being aware of.

> >
> > Additionally, drop the !sockc_err gate from the devmem validation check
> > and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
> > followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
> > not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
> > proceed and return before sockc_err is checked.
> >
> > This pre-existing issue was identified by Sashiko AI review on commit
> > 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
> > hit in production.
> >
> > Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
> > Fixes: bd61848900bf ("net: devmem: Implement TX path")
> > Reviewed-by: Mina Almasry <almasrymina@google.com>
> > Signed-off-by: Kaifeng Wang <kaifengw@google.com>
> > ---
> > v1 -> v2:
> > - Move the devmem rejection checks into the Fast Open and TCP repair
> >    branches directly, also covering the case where tp->repair is enabled
> >    while sk_stream_wait_connect() drops the socket lock.
> > - Drop the !sockc_err gate from the devmem validation check and return
> >    sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
> >    failing cmsg from bypassing the check.
> >
> >   net/ipv4/tcp.c | 12 ++++++++++--
> >   1 file changed, 10 insertions(+), 2 deletions(-)
> >
> > diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> > index 87ef6d5cbfeb..2792923f0748 100644
> > --- a/net/ipv4/tcp.c
> > +++ b/net/ipv4/tcp.c
> > @@ -1169,14 +1169,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
> >                       zc = MSG_SPLICE_PAGES;
> >       }
> >
> > -     if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> > -             err = -EINVAL;
> > +     if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> > +             err = sockc_err ?: -EINVAL;
> >               goto out_err;
> >       }
> >
> >       if (unlikely(flags & MSG_FASTOPEN ||
> >                    inet_test_bit(DEFER_CONNECT, sk)) &&
> >           !tp->repair) {
> > +             if (binding) {
> > +                     err = -EINVAL;
> > +                     goto out_err;
> > +             }
> >               err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size, uarg);
> >               if (err == -EINPROGRESS && copied_syn > 0)
> >                       goto out;
> > @@ -1200,6 +1204,10 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
> >       }
> >
> >       if (unlikely(tp->repair)) {
> > +             if (binding) {
> > +                     err = -EINVAL;
> > +                     goto out_err;
> > +             }
> >               if (tp->repair_queue == TCP_RECV_QUEUE) {
> >                       copied = tcp_send_rcvq(sk, msg, size);
> >                       goto out_nopush;
>
> The ever increasing number of conditionals is a bit concerning, but
> I don't see how to avoid the new ones.

Yes. sendmsg() has been hijacked by so many slow path components.

At least this patch only adds code in unlikely() branches.

Reviewed-by: Eric Dumazet <edumazet@kernel.org>

Thanks.

Re: [PATCH net v2] tcp: reject devmem tx with fastopen and repair

[Pavel Begunkov]

On 10/19/26 18:45, Kaifeng Wang wrote:
> tcp_sendmsg_locked() enforces that devmem TX can only proceed if the
> zero-copy path is active and a valid dmabuf binding exists. However,
> subsequent branches in tcp_sendmsg_locked() can still intercept the
> message before it reaches the devmem zero-copy loop:
> 
> 1. TCP Fast Open (MSG_FASTOPEN or DEFER_CONNECT):
>     If TCP_FASTOPEN_CONNECT is set, the socket may have a valid dst with
>     NETIF_F_SG (so zc == MSG_ZEROCOPY and binding is present), but
>     tcp_sendmsg_fastopen() -> tcp_send_syn_data() will use
>     copy_page_from_iter() to byte-copy from the iterator. Since iov_base
>     represents dma-buf offsets rather than user virtual addresses, this
>     misinterprets offsets as user pointers and copies the caller's memory
>     at those addresses into the SYN packet.
> 
> 2. TCP repair mode:
>     If tp->repair is enabled with TCP_RECV_QUEUE, tcp_send_rcvq() similarly
>     calls skb_copy_datagram_from_iter(), byte-copying from the iterator.
> 
> Neither path supports or makes sense for devmem transmission. Reject
> devmem sends inside the Fast Open and TCP repair branches when a devmem
> binding is present. Checking inside the tp->repair branch also covers
> the case where repair mode is enabled while sk_stream_wait_connect()
> drops the socket lock.
> 
> Additionally, drop the !sockc_err gate from the devmem validation check
> and return sockc_err if set. Otherwise, if a valid SCM_DEVMEM_DMABUF is
> followed by a failing cmsg, sockc.dmabuf_id remains set while binding is
> not acquired, allowing the Fast Open and TCP_RECV_QUEUE repair paths to
> proceed and return before sockc_err is checked.
> 
> This pre-existing issue was identified by Sashiko AI review on commit
> 125755776bc6 ("tcp: reject non zerocopy devmem tx") and has not been
> hit in production.
> 
> Fixes: 125755776bc6 ("tcp: reject non zerocopy devmem tx")
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Reviewed-by: Mina Almasry <almasrymina@google.com>
> Signed-off-by: Kaifeng Wang <kaifengw@google.com>
> ---
> v1 -> v2:
> - Move the devmem rejection checks into the Fast Open and TCP repair
>    branches directly, also covering the case where tp->repair is enabled
>    while sk_stream_wait_connect() drops the socket lock.
> - Drop the !sockc_err gate from the devmem validation check and return
>    sockc_err if set, preventing a valid SCM_DEVMEM_DMABUF followed by a
>    failing cmsg from bypassing the check.
> 
>   net/ipv4/tcp.c | 12 ++++++++++--
>   1 file changed, 10 insertions(+), 2 deletions(-)
> 
> diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
> index 87ef6d5cbfeb..2792923f0748 100644
> --- a/net/ipv4/tcp.c
> +++ b/net/ipv4/tcp.c
> @@ -1169,14 +1169,18 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>   			zc = MSG_SPLICE_PAGES;
>   	}
>   
> -	if (!sockc_err && sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {
> -		err = -EINVAL;
> +	if (sockc.dmabuf_id && (zc != MSG_ZEROCOPY || !binding)) {

I wonder why it does sockc_err checks like that for devmem, e.g. instead of
failing earlier. Maybe Mina remembers?

> +		err = sockc_err ?: -EINVAL;
>   		goto out_err;
>   	}
>   
>   	if (unlikely(flags & MSG_FASTOPEN ||
>   		     inet_test_bit(DEFER_CONNECT, sk)) &&
>   	    !tp->repair) {
> +		if (binding) {
> +			err = -EINVAL;
> +			goto out_err;
> +		}
>   		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size, uarg);
>   		if (err == -EINPROGRESS && copied_syn > 0)
>   			goto out;
> @@ -1200,6 +1204,10 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
>   	}
>   
>   	if (unlikely(tp->repair)) {
> +		if (binding) {
> +			err = -EINVAL;
> +			goto out_err;
> +		}
>   		if (tp->repair_queue == TCP_RECV_QUEUE) {
>   			copied = tcp_send_rcvq(sk, msg, size);
>   			goto out_nopush;

Reviewed-by: Pavel Begunkov <asml.silence@gmail.com>

-- 
Pavel Begunkov