Re: [PATCH] af_unix: mark MSG_SPLICE_PAGES frags shared

[Kuniyuki Iwashima]

On Tue, Jun 30, 2026 at 12:06 AM Yiming Qian <yimingqian591@xxxxxxxxx> wrote:
>
> unix_stream_sendmsg() splices external pages directly into skb frags when
> MSG_SPLICE_PAGES is set, but it does not propagate SKBFL_SHARED_FRAG
> afterward.

I think it doesn't matter with the plain AF_UNIX.

Please elaborate on the scenario where this could be a problem.
e.g. sockmap ?


>
> That leaves later writers without the shared-frag marker even though the
> skb still references externally owned pages.
>
> Set the marker after a successful skb_splice_from_iter() call.
>
> Fixes: a0dbf5f818f90 ("af_unix: Support MSG_SPLICE_PAGES")
> Reported-by: Yiming Qian <yimingqian591@xxxxxxxxx>
> Reported-by: Can Liu <lingchen5202005@xxxxxxxxx>

Reported-by is not needed when it's identical to SOB tag.


> Signed-off-by: Yiming Qian <yimingqian591@xxxxxxxxx>
> Signed-off-by: Can Liu <lingchen5202005@xxxxxxxxx>
> ---
>  net/unix/af_unix.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
> index f7a9d55eee8a1..f2cd0f8ec0914 100644
> --- a/net/unix/af_unix.c
> +++ b/net/unix/af_unix.c
> @@ -2458,6 +2458,7 @@ static int unix_stream_sendmsg(struct socket *sock, struct msghdr *msg,
>                                 goto out_free;
>
>                         size = err;
> +                       skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
>                         refcount_add(size, &sk->sk_wmem_alloc);
>                 } else {
>                         skb_put(skb, size - data_len);
> --
> 2.34.1