Re: [PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-06-30 15:51:13
Also in:
lkml
On Tue, Jun 30, 2026 at 12:06 AM Yiming Qian [off-list ref] wrote:
unix_stream_sendmsg() splices external pages directly into skb frags when MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG afterward.
I think it doesn't matter with the plain AF_UNIX. Please elaborate on the scenario where this could be a problem. e.g. sockmap ?
That leaves later writers without the shared-frag marker even though the
skb still references externally owned pages.
Set the marker after a successful skb_splice_from_iter() call.
Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES")
Reported-by: Yiming Qian <redacted>
Reported-by: Can Liu <redacted>Reported-by is not needed when it's identical to SOB tag.
quoted hunk ↗ jump to hunk
Signed-off-by: Yiming Qian <redacted> Signed-off-by: Can Liu <redacted> --- net/unix/af_unix.c | 1 + 1 file changed, 1 insertion(+)diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index f7a9d55eee8a1..f2cd0f8ec0914 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c@@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg, goto out_free; size = err; + skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; refcount_add(size, &sk->sk_wmem_alloc); } else { skb_put(skb, size - data_len); --2.34.1