From: Eric Dumazet <edumazet@xxxxxxxxxx> commit b67985be400969578d4d4b17299714c0e5d2c07b upstream. tcp_shift_skb_data() might collapse three packets into a larger one. P_A, P_B, P_C -> P_ABC Historically, it used a single tcp_skb_can_collapse_to(P_A) call, because it was enough. In commit 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions"), this call was replaced by a call to tcp_skb_can_collapse(P_A, P_B) But the now needed test over P_C has been missed. This probably broke MPTCP. Then later, commit 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") added an extra condition to tcp_skb_can_collapse(), but the missing call from tcp_shift_skb_data() is also breaking TCP zerocopy, because P_A and P_C might have different skb_zcopy_pure() status. Fixes: 85712484110d ("tcp: coalesce/collapse must respect MPTCP extensions") Fixes: 9b65b17db723 ("net: avoid double accounting for pure zerocopy skbs") Signed-off-by: Eric Dumazet <edumazet@xxxxxxxxxx> Cc: Mat Martineau <mathew.j.martineau@xxxxxxxxxxxxxxx> Cc: Talal Ahmad <talalahmad@xxxxxxxxxx> Cc: Arjun Roy <arjunroy@xxxxxxxxxx> Cc: Willem de Bruijn <willemb@xxxxxxxxxx> Acked-by: Soheil Hassas Yeganeh <soheil@xxxxxxxxxx> Acked-by: Paolo Abeni <pabeni@xxxxxxxxxx> Link: https://lore.kernel.org/r/20220201184640.756716-1-eric.dumazet@xxxxxxxxx Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/ipv4/tcp_input.c | 2 ++ 1 file changed, 2 insertions(+) --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1620,6 +1620,8 @@ static struct sk_buff *tcp_shift_skb_dat (mss != tcp_skb_seglen(skb))) goto out; + if (!tcp_skb_can_collapse(prev, skb)) + goto out; len = skb->len; pcount = tcp_skb_pcount(skb); if (tcp_skb_shift(prev, skb, pcount, len)) Patches currently in stable-queue which might be from edumazet@xxxxxxxxxx are queue-5.10/rtnetlink-make-sure-to-refresh-master_dev-m_ops-in-__rtnl_newlink.patch queue-5.10/tcp-add-missing-tcp_skb_can_collapse-test-in-tcp_shift_skb_data.patch queue-5.10/af_packet-fix-data-race-in-packet_setsockopt-packet_setsockopt.patch queue-5.10/net-sched-fix-use-after-free-in-tc_new_tfilter.patch