CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of TCP transmission when using devmem without zero-copy, potentially allowing the mixing of readable and unreadable fragments in a single socket buffer (skb). This could lead to data integrity issues and violate expected invariants, posing a risk to systems relying on secure and efficient TCP operations. Organizations using Linux in environments where TCP performance and data integrity are critical should prioritize addressing this vulnerability.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked() will try the copy path and try to copy data from an iovec which consists of offsets into the dma-buf and would normally fail. Moreover, d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags") relies on that and assumes that the devmem binding is present IFF we're using the zero-copy path, which can be used to mix net-iov and pages in a single skb, and break invariants. Let's reject devmem tx without zero-copy. Note, the parameter check the patch is modifying is too loose, we can create an io_uring request with dmabuf_id and all ZC flags, but which won't have the binding. We replace it with stricter validation.